CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
Zabbix Frontend Authentication Bypass Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2022-23131
Description
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitation Context
as of October 17, 2026- CISA added CVE-2022-23131 to the KEV catalog 40 days after its CVE record was published.
- It is one of 2 Zabbix entries in the CISA KEV catalog, and one of 2 added in 2022.
- Its current EPSS score (95.7%) is higher than that of 79% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Zabbix | Zabbix Frontend | 5.4.0 - 5.4.8 5.4.9 to <5.4.9* (unaffected) |
References
1 LinksRecord Details
More from Zabbix
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.