Improper Access Control in Zabbix Frontend (CVE‑2022‑23134) Allows Configuration Changes
What It Is — CVE‑2022‑23134 is an improper access‑control flaw in the Zabbix web frontend that lets an unauthenticated or low‑privilege user bypass the normal step‑check workflow and issue configuration‑changing requests. The vulnerability resides in the UI’s request‑validation logic, not in the underlying monitoring engine.
Exploitability — Public proof‑of‑concept code exists; an attacker can trigger the flaw over HTTP without needing prior authentication. The National Vulnerability Database rates the CVSS v3.1 base score at 7.5 (High), with network‑vector and no privileges required.
Affected Products — All Zabbix installations running the frontend component prior to the vendor‑released patch (versions 5.0.x‑5.4.x). The issue is independent of the backend database or agent components.
Why It Matters for Trust & Control Assurance
- Access‑control assurance – The flaw demonstrates a gap in the “who can change what” control objective, a core element of continuous audit evidence across SOC 2, ISO 27001, and NIST CSF.
- Configuration‑change monitoring – Without proper gating, organizations lose a reliable log of who altered monitoring thresholds, which weakens their ability to produce defensible evidence for auditors.
- Supply‑chain risk – Zabbix is widely used to monitor critical infrastructure; a compromised frontend can silently alter alerts, undermining downstream security controls.
Recommended Actions
- Apply the vendor patch immediately (see Zabbix security advisory).
- Review and tighten frontend access policies – enforce least‑privilege roles, enable multi‑factor authentication for all UI accounts.
- Enable detailed audit logging for configuration changes and integrate logs into a SIEM for continuous monitoring.
- Validate post‑patch by testing that step‑checks cannot be bypassed and that only authorized roles can modify settings.
Source: CISA KEV – CVE‑2022‑23134