CVE-2022-23133 Stored XSS in host groups configuration window in Zabbix Frontend
An authenticated attacker can inject stored XSS payloads into host group configurations, allowing session hijacking and account takeover of other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23133?
CVE-2022-23133 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 13 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.
Weakness: CWE-79
Which versions are affected by CVE-2022-23133?
It affects 2 products.
Products include Fedoraproject Fedora, Zabbix Zabbix.
How do I fix CVE-2022-23133?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-23133 being exploited?
There is no known exploitation of CVE-2022-23133 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2022-23133, GHSA-2r84-x97c-3ch4, UBUNTU-CVE-2022-23133.