CVE-2022-35230: Zabbix

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

Affected products

• Zabbix Zabbix: before 5.0.25 (fixed in 5.0.25); version 5.0.25 only

Published 2022-07-06. Last modified 2026-06-17.