Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-35229
HistoryJul 06, 2022 - 11:15 a.m.

CVE-2022-35229

2022-07-0611:15:08
CWE-79
[email protected]
web.nvd.nist.gov
12
authenticated user
reflected javascript
discovery page
csrf token

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

28.8%

JSON

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

Affected configurations

Nvd
Node
zabbixzabbixRange<4.0.0
OR
zabbixzabbixRange5.0.0–5.0.25
OR
zabbixzabbixRange6.0.0–6.0.4
OR
zabbixzabbixMatch5.0.25-
VendorProductVersionCPE
zabbixzabbix*cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
zabbixzabbix5.0.25cpe:2.3:a:zabbix:zabbix:5.0.25:-:*:*:*:*:*:*

Related

ubuntucve 1
cvelist 1
prion 1
osv 3
cve 1
debiancve 1
cnvd 1
openvas 3
nessus 1
ubuntu 1
debian 3
ubuntucve
ubuntucve
CVE-2022-35229
2022-07-06 00:00:00
cvelist
cvelist
CVE-2022-35229 Reflected XSS in discovery page of Zabbix Frontend
2022-07-06 11:05:12
prion
prion
Cross site request forgery (csrf)
2022-07-06 11:15:00
osv
osv
CVE-2022-35229
2022-07-06 11:15:08
zabbix vulnerabilities
2024-04-25 20:13:57
zabbix - security update
2023-04-12 00:00:00
cve
cve
CVE-2022-35229
2022-07-06 11:15:08
debiancve
debiancve
CVE-2022-35229
2022-07-06 11:15:08
cnvd
cnvd
Zabbix Frontend Cross-Site Scripting Vulnerability (CNVD-2022-56704)
2022-07-08 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-6751-1)
2024-04-26 00:00:00
Debian: Security Advisory (DLA-3390-1)
2023-04-13 00:00:00
Debian: Security Advisory (DLA-3538-1)
2023-08-22 00:00:00
nessus
nessus
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Zabbix vulnerabilities (USN-6751-1)
2024-04-25 00:00:00
ubuntu
ubuntu
Zabbix vulnerabilities
2024-04-25 00:00:00
debian
debian
[SECURITY] [DLA 3390-1] zabbix security update
2023-04-12 13:46:20
[SECURITY] [DLA 3390-1] zabbix security update
2023-04-12 13:36:51
[SECURITY] [DLA 3538-1] zabbix security update
2023-08-22 13:22:21

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

28.8%

JSON
Related for NVD:CVE-2022-35229
ubuntucve1cvelist1prion1osv3cve1debiancve1cnvd1openvas3nessus1ubuntu1debian3