CVE-2022-35229: Zabbix

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

Affected products

• Zabbix Zabbix: before 4.0.0 (fixed in 4.0.0); from 5.0.0, before 5.0.25 (fixed in 5.0.25); from 6.0.0, up to and including 6.0.4; version 5.0.25 only

Published 2022-07-06. Last modified 2026-06-17.