Critical severity · published Dec 5, 2022
CVE-2022-43515
X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being disclosed. An attacker can bypass this protection and access the instance using IP address not listed in the defined range.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZA
Zabbix · Zabbix
4.0.0-4.0.44; 5.0.0-5.0.29; 6.0.0-6.0.9; 6.2.0-6.2.4 · source: vendor
FR
Frontend · Zabbix
4.0.0 through 4.0.44; 5.0.0 through 5.0.29; 6.0.0 through 6.0.9; 6.2.0 through 6.2.4; 5.0.30; 6.0.11; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43515
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
Exploit
https://support.zabbix.com/browse/ZBX-22050
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
More from Zabbix
9.8
CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
5.3
CVE-2022-23134
Possible view of the setup pages by unauthenticated users if config file already exists
9.9
CVE-2024-42327
SQL injection in user.get API
9.8
CVE-2023-32728
Code injection in zabbix_agent2 smart.disk.get caused by smartctl plugin
9.8
CVE-2023-29453
Agent 2 package are built with Go version affected by CVE-2023-24538