CVE-2022-23133: 
Zabbix Server vulnerability analysis and mitigation

CVE-2022-23133 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Zabbix Frontend that affects versions 5.0.0 through 5.0.18 and 5.4.0 through 5.4.8. The vulnerability was disclosed on January 13, 2022, and allows authenticated users to create host groups with malicious XSS payloads (NVD, Zabbix Issue).

The vulnerability exists in the host groups configuration window of the Zabbix Frontend. It allows an authenticated user to inject malicious XSS payloads during host group creation. The vulnerability has been assigned a CVSS v3.1 base score of 6.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD).

When successfully exploited, the stored XSS payload is triggered when other users search for groups during new host creation. This allows the attacker to steal session cookies and perform session hijacking, potentially leading to account takeover and impersonation of other users (Zabbix Issue).

The vulnerability was fixed in Zabbix versions 5.0.19rc1, 5.4.9rc1, and 6.0.0beta1. Users are advised to upgrade to these or later versions to mitigate the vulnerability. The fix was also backported to various Linux distributions, including Fedora 34 and 35 through security updates (Fedora Update).