{"id":"CVE-2022-23134","published":"2022-01-13T16:15:08Z","modified":"2026-06-17T04:29:34Z","title":"Zabbix Frontend Improper Access Control Vulnerability","vendor":"Zabbix","product":"Frontend","tier":"core","eol":null,"description":{"text":"After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.","provenance":"source","from":"NVD"},"summary":{"text":"The Zabbix Frontend, Zabbix's web interface, contains an improper access control flaw in which some steps of its setup.php file remain reachable by unauthenticated users after initial setup, not only by super-administrators. An attacker with network access and no credentials or user interaction can pass the step checks and potentially change the configuration of the Zabbix Frontend.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:06Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.9526,"percentile":0.99865,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-02-22","dueDate":"2022-03-08","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-23134","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-02-22","exploitedFirstSeen":"2022-02-22","ransomware":false,"evidence":[{"url":"https://cert.gov.ua/article/37287","date":"2022-02-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-02-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-24&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2022-23134","date":"2026-09-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2022-23134","date":"2026-10-01"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/","tags":["Release Notes"]},{"url":"https://support.zabbix.com/browse/ZBX-20384","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/","tags":["Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/","tags":["Release Notes"]},{"url":"https://support.zabbix.com/browse/ZBX-20384","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote access to public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well","start":33,"end":146}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker alters application configuration, integrity impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend","start":148,"end":244}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-28225","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28225","exploited":true,"exploitedSince":"2022-02-22","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-03-23","earliestUrl":"https://github.com/TheN00bBuilder/cve-2022-23134-poc-and-writeup","repos":[{"name":"TheN00bBuilder/cve-2022-23134-poc-and-writeup","url":"https://github.com/TheN00bBuilder/cve-2022-23134-poc-and-writeup","stars":1,"created":"2025-03-23"}]},"nuclei":[{"id":"CVE-2022-23134","name":"Zabbix Setup Configuration Authentication Bypass","severity":"medium","path":"http/cves/2022/CVE-2022-23134.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23134.yaml"}],"first":{"date":"2025-03-23","source":"PoC-in-GitHub","url":"https://github.com/TheN00bBuilder/cve-2022-23134-poc-and-writeup"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1485"],"provenance":"ai"}],"timeline":[{"date":"2022-01-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23134","provenance":"source"},{"date":"2022-02-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cert.gov.ua/article/37287","provenance":"source"},{"date":"2022-02-22","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-22","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28225","provenance":"source"},{"date":"2025-03-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/TheN00bBuilder/cve-2022-23134-poc-and-writeup","provenance":"source"}],"speed":{"daysToPublicExploit":1165,"firstExploitFrom":"PoC-in-GitHub","daysToKev":40},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1710 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}