Security update for zabbix SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1254-1 Final 1 1 2022-04-19T07:12:53Z current 2022-04-19T07:12:53Z 2022-04-19T07:12:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for zabbix This update for zabbix fixes the following issues: - CVE-2022-24349: Fixed a reflected XSS in the action configuration window (bsc#1196944). - CVE-2022-24917: Fixed a reflected XSS in the service configuration window (bsc#1196945). - CVE-2022-24918: Fixed a reflected XSS in the item configuration window (bsc#1196946). - CVE-2022-24919: Fixed a reflected XSS in the graph configuration window (bsc#1196947). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1254,SUSE-SLE-SERVER-12-SP5-2022-1254 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221254-1/ Link for SUSE-SU-2022:1254-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010744.html E-Mail link for SUSE-SU-2022:1254-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1196944 SUSE Bug 1196944 https://bugzilla.suse.com/1196945 SUSE Bug 1196945 https://bugzilla.suse.com/1196946 SUSE Bug 1196946 https://bugzilla.suse.com/1196947 SUSE Bug 1196947 https://www.suse.com/security/cve/CVE-2022-24349/ SUSE CVE CVE-2022-24349 page https://www.suse.com/security/cve/CVE-2022-24917/ SUSE CVE CVE-2022-24917 page https://www.suse.com/security/cve/CVE-2022-24918/ SUSE CVE CVE-2022-24918 page https://www.suse.com/security/cve/CVE-2022-24919/ SUSE CVE CVE-2022-24919 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 zabbix-agent-4.0.12-4.15.2 zabbix-java-gateway-4.0.12-4.15.2 zabbix-phpfrontend-4.0.12-4.15.2 zabbix-proxy-4.0.12-4.15.2 zabbix-proxy-mysql-4.0.12-4.15.2 zabbix-proxy-postgresql-4.0.12-4.15.2 zabbix-proxy-sqlite-4.0.12-4.15.2 zabbix-server-4.0.12-4.15.2 zabbix-server-mysql-4.0.12-4.15.2 zabbix-server-postgresql-4.0.12-4.15.2 zabbix-agent-4.0.12-4.15.2 as a component of SUSE Linux Enterprise Server 12 SP5 zabbix-agent-4.0.12-4.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel. CVE-2022-24349 SUSE Linux Enterprise Server 12 SP5:zabbix-agent-4.0.12-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:zabbix-agent-4.0.12-4.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221254-1/ https://www.suse.com/security/cve/CVE-2022-24349.html CVE-2022-24349 https://bugzilla.suse.com/1196944 SUSE Bug 1196944 An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. CVE-2022-24917 SUSE Linux Enterprise Server 12 SP5:zabbix-agent-4.0.12-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:zabbix-agent-4.0.12-4.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221254-1/ https://www.suse.com/security/cve/CVE-2022-24917.html CVE-2022-24917 https://bugzilla.suse.com/1196945 SUSE Bug 1196945 An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. CVE-2022-24918 SUSE Linux Enterprise Server 12 SP5:zabbix-agent-4.0.12-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:zabbix-agent-4.0.12-4.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221254-1/ https://www.suse.com/security/cve/CVE-2022-24918.html CVE-2022-24918 https://bugzilla.suse.com/1196946 SUSE Bug 1196946 An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. CVE-2022-24919 SUSE Linux Enterprise Server 12 SP5:zabbix-agent-4.0.12-4.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5:zabbix-agent-4.0.12-4.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221254-1/ https://www.suse.com/security/cve/CVE-2022-24919.html CVE-2022-24919 https://bugzilla.suse.com/1196947 SUSE Bug 1196947