Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-23134

CVE-2022-23134LOW

Zabbix Frontend — Possible view of the setup pages by unauthenticated users if config file already exists

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  N  L  N    3.7   .9526   99.9   YES

AFFECTED
  Product   Versions         Fixed
  Frontend  5.4.0 - 5.4.8 –  5.4.9

TIMELINE
  Jan 11  Reserved by Zabbix
  Jan 13  Published (CNA: Zabbix)
  Feb 22  Added to CISA KEV, remediation due 2022-03-08

CWE-284 · CNA: Zabbix · CVSS v3.1 · 5 references · KEV due March 8, 2022

Description

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 11, 2022	Reserved	Reserved by Zabbix
January 13, 2022	Published	Published (CNA: Zabbix)
February 22, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-03-08

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Zabbix	Frontend	—	5.4.0 - 5.4.8	5.4.9

Weaknesses

CWE-284

References (5)

https://lists.debian.org/debian-lts-announce/2022/02/msg00008.html [mailing-list, x_refsource_MLIST]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6SZYHXINBKCY42ITFSNCYE7KCSF33VRA/ [vendor-advisory, x_refsource_FEDORA]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB6W556GVXOKUYTASTDGL3AI7S3SJHX7/ [vendor-advisory, x_refsource_FEDORA]
https://support.zabbix.com/browse/ZBX-20384 [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134 [government-resource]

Authoritative record: CVE-2022-23134 at cve.org

Vendors: zabbix

Weaknesses: CWE-284

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-23134 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.