According to its self-reported version number, the instance of Zabbix running on the remote host is 5.4.x prior to 5.4.9. It is, therefore, affected by multiple vulnerabilities:

  - In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified     by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor     may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack,     SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the     guest account, which is disabled by default). (CVE-2022-23131)

  - During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in     [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute     permissions check on the file system level. (CVE-2022-23132)

  - An authenticated user can create a hosts group from the configuration with XSS payload, which will be available     for other users. (CVE-2022-23133)

  - After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but     by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of     Zabbix Frontend. (CVE-2022-23134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Zabbix 5.4.x < 5.4.9 Multiple Vulnerabilities

critical Nessus Plugin ID 158452

Version 1.8

Version 1.7

Version 1.8 Jun 5, 2024, 1:32 PM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202406051332
Version 1.7 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311