CVE Feed

    Dashboard / CVE / CVE-2022-23131

    CVE-2022-23131

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

    Published:Jan 13, 2022
    Last Modified:Oct 30, 2025
    EPS:Jan 13, 2022
    EPSS Score:0.94252
    CVSS Score:9.1

    CISA Notification

    Description

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Mar 8, 2022
    1648 days ago
    Alert Date
    Feb 22, 2022
    1662 days ago

    Affected Products

    Vendor
    Zabbix
    Product
    Zabbix

    Exploits

    https://github.com/1mxml/CVE-2022-23131https://github.com/Arrnitage/CVE-2022-23131_exphttps://github.com/clearcdq/Zabbix-SAML-SSO-_CVE-2022-23131https://github.com/dagowda/Zabbix-cve-2022-23131-SSO-bypasshttps://github.com/davidzzo23/CVE-2022-23131https://github.com/Fa1c0n35/zabbix-cve-2022-23131https://github.com/fork-bombed/CVE-2022-23131https://github.com/jweny/CVE-2022-23131https://github.com/Kazaf6s/CVE-2022-23131https://github.com/kh4sh3i/CVE-2022-23131https://github.com/L0ading-x/cve-2022-23131https://github.com/Mr-xn/cve-2022-23131https://github.com/pykiller/CVE-2022-23131https://github.com/qq1549176285/CVE-2022-23131https://github.com/r10lab/CVE-2022-23131https://github.com/random-robbie/cve-2022-23131-exphttps://github.com/SCAMagic/CVE-2022-23131poc-exp-zabbix-https://github.com/trganda/CVE-2022-23131https://github.com/Vulnmachines/Zabbix-CVE-2022-23131https://github.com/wr0x00/cve-2022-23131https://github.com/zwjjustdoit/cve-2022-23131

    Related CVEs

    CVE-2026-59781 (CVSS 5.4) — When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify …
    CVE-2026-23938 (CVSS 2.1) — An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted prepro…
    CVE-2026-23937 (CVSS 6) — The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to …
    CVE-2026-23935 (CVSS 6.8) — A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (…
    CVE-2026-23934 (CVSS 5.1) — An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specific…
    CVE-2026-23933 (CVSS 7.7) — In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the dat…
    CVE-2026-23931 (CVSS 5.3) — The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user ma…
    CVE-2026-23930 (CVSS 5.3) — An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specif…
    CVE-2026-23929 (CVSS 8.5) — Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parame…
    CVE-2026-1199 (CVSS 6.9) — Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not p…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High