Zabbix Frontend Improper Access Control Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 22/02/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| zabbix | = 6.0.0≥ 5.4.0, ≤ 5.4.8 |
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free