CVE-2022-23131Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
Updated under an hour ago ()
Does this affect you?
It affects Zabbix Frontend and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Feb 22, 2022; federal agencies had to remediate by Mar 8, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-290
- Known exploited
- Added to CISA KEV Feb 22, 2022; federal remediation due Mar 8, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 95.68% (percentile 100)
- Assigned by
- Zabbix
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Zabbix Frontend zabbix:frontend (from the name) | 5.4.0 - 5.4.8; from 5.4.9 before 5.4.9* not affected | CNA record |
zabbix zabbix zabbix:zabbix | from 5.4.0 through 5.4.8; 6.0.0 | NVD |
References
- https://support.zabbix.com/browse/ZBX-20350x-refsource-misc, issue-tracking, patch, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23131us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.