CVE-2022-43515 X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode
Attackers can bypass maintenance mode IP restrictions by spoofing the X-Forwarded-For header, gaining unauthorized access to the Zabbix Frontend.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43515?
CVE-2022-43515 is a medium-severity authentication bypass vulnerability in Zabbix Frontend, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being disclosed. An attacker can bypass this protection and access the instance using IP address not listed in the defined range.
Which versions are affected by CVE-2022-43515?
It affects 1 product.
Linux distribution packages (7)
zabbix SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 4.0.12-4.21.1 |
zabbix SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 4.0.12-4.21.1 |
zabbix SUSE:Linux Enterprise Server 12 SP5 | All versions | 4.0.12-4.21.1 |
zabbix SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 4.0.12-4.21.1 |
zabbix SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 4.0.12-4.21.1 |
zabbix SUSE:OpenStack Cloud 9 | All versions | 4.0.12-4.21.1 |
zabbix SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.0.12-4.21.1 |
Products include Zabbix Frontend.
How do I fix CVE-2022-43515?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-43515 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-43515 exists.
Other vulnerabilities in Zabbix Frontend
- CVE-2023-32725 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2025-27232 Frontend arbitrary file read in oauth.authorize action
- CVE-2023-29457 Insufficient validation of Action form input fields
- CVE-2025-49643 Frontend DoS vulnerability due to asymmetric resource consumption
- CVE-2023-29456 Inefficient URL schema validation
Sources
Also known as DEBIAN-CVE-2022-43515, GHSA-hh7f-cch9-52mr, SUSE-SU-2022:4477-1, UBUNTU-CVE-2022-43515.