CVE-2022-23131
CISA 기관 조치 기한: 2022-03-08
Zabbix Frontend
Qualys 위협 인텔 · 심각도 4/5 · QID 730364 · CGI
공개 익스플로잇
웜 전파
인증 불필요
원격코드실행
CISA KEV
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
KEV 필수 조치: Apply updates per vendor instructions.
타임라인
- NVD 공개
- CISA KEV 등재(실제 악용 확인) 공개 후 40일
- CISA 기관 조치 기한 경과
날짜 정보 없는 신호: 공개 PoC 14건 웜 전파
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
공개 익스플로잇 / PoC
- GitHub 공개 PoC 14건 — 대표 레포 ↗