Zabbix Frontend
19 CVEs affecting Zabbix Frontend. Latest disclosed: 2025-12-01. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32725 | Critical | 9.6 | 2023-12-18 | The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be use… |
CVE-2022-23131 | Critical | 9.1 | 2022-01-13 | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login st… |
CVE-2025-49643 | Medium | 6.5 | 2025-12-01 | An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore… |
CVE-2023-29457 | Medium | 6.3 | 2023-07-13 | Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action for… |
CVE-2022-23133 | Medium | 6.3 | 2022-01-13 | An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authe… |
CVE-2023-29456 | Medium | 5.7 | 2023-07-13 | URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL component… |
CVE-2023-29455 | Medium | 5.4 | 2023-07-13 | Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The scri… |
CVE-2023-29454 | Medium | 5.4 | 2023-07-13 | Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves… |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2025-27232 | Medium | 4.9 | 2025-12-01 | An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss. |
CVE-2022-40626 | Medium | 4.8 | 2022-09-14 | An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to crea… |
CVE-2023-30958 | Medium | 4.7 | 2023-08-03 | A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defe… |
CVE-2022-24349 | Medium | 4.6 | 2022-03-09 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same ob… |
CVE-2022-35230 | Low | 3.7 | 2022-07-06 | An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed on… |
CVE-2022-35229 | Low | 3.7 | 2022-07-06 | An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed… |
CVE-2022-24919 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only… |
CVE-2022-24918 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only w… |
CVE-2022-24917 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed onl… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |