medium4.8
CVE-2022-40626
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to crea…
Impact
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zabbix | Zabbix | from 6.0.0 through 6.0.6 Version 6.2.0 |
| Fedoraproject | Fedora | Version 37 |
Weakness classification
References
- NVD record
- CVE.org record
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPU4RCRYVNVM3SS523UQXE63ATCTEX5G/
- https://support.zabbix.com/browse/ZBX-21350
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPU4RCRYVNVM3SS523UQXE63ATCTEX5G/
- https://support.zabbix.com/browse/ZBX-21350