Security readout for executives and security teams
Plain-English summary
This flaw affects Zabbix Frontend setup handling after installation. An unauthenticated attacker may reach parts of setup.php and potentially alter frontend configuration. The CVSS score is low, but CISA KEV listing means exploitation has been observed and exposed Zabbix systems deserve prompt attention.
Executive priority
Treat as a time-bound remediation item, not a theoretical low-severity issue. KEV status raises operational priority because exploitation is confirmed, even though the technical impact is limited to integrity.
Technical view
CVE-2022-23134 is an improper access control issue in Zabbix Frontend 5.4.0 through 5.4.9. When the configuration file already exists, some setup.php steps remain reachable without super-admin authentication. Successful abuse may permit limited configuration integrity impact.
Likely exposure
Exposure is most likely where affected Zabbix Frontend versions are reachable over a network, especially internet-facing monitoring portals or unmanaged distro packages.
Exploitation context
Active exploitation is supported by the CISA Known Exploited Vulnerabilities catalog entry for CVE-2022-23134. The provided sources do not describe exploit volume, targets, or public exploit mechanics.
Researcher notes
The record identifies high attack complexity, no privileges required, no user interaction, and low integrity impact. Evidence does not support claims of confidentiality loss, availability impact, affected versions beyond listed Zabbix Frontend releases, or specific exploit techniques.
Mitigation direction
- Apply the relevant Zabbix, Fedora, or Debian security update.
- Prioritize internet-facing Zabbix Frontend instances for remediation.
- Confirm vendor guidance before relying on temporary workarounds.
- Track completion against CISA KEV-driven remediation obligations where applicable.
Validation and detection
- Inventory Zabbix Frontend versions across production and internal monitoring systems.
- Check whether deployed versions match 5.4.0 through 5.4.9.
- Verify affected systems received vendor or distribution security updates.
- Review web exposure of Zabbix frontend and setup.php paths.
- Look for unexpected Zabbix frontend configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-23134 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N2.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://support.zabbix.com/browse/ZBX-20384CVE reference · x_refsource_MISC
- FEDORA-2022-dfe346f53fCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-1a667b0f90CVE reference · vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20220207 [SECURITY] [DLA 2914-1] zabbix security updateCVE reference · mailing-list, x_refsource_MLIST
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23134CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.