Zabbix Frontend Improper Access Control Vulnerability

概要

参考情報

• lists.debian.org/debian-lts-announce/2022/02/msg00008.html · Mailing List
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA · Release Notes
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7 · Release Notes
• support.zabbix.com/browse/ZBX-20384 · Issue Tracking
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2022-23134

zabbix のその他の脆弱性

• CVE-2026-59781高 7.8When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory…
• CVE-2026-23938中 4.9An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript…
• CVE-2026-23937中 6.5The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integri…
• CVE-2026-23935中 4.9A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic,…
• CVE-2026-23934中 6.5An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the F…