{
  "cveId": "CVE-2022-24919",
  "url": "https://patchblox.com/security/cve/CVE-2022-24919",
  "summary": "CVE-2022-24919 is fixed in zabbix on 1 platform, first by DEBIAN-CVE-2022-24919, released March 9, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "zabbix: An authenticated user can create a link with reflected Javascript code inside it for graphs\u2019 page and send it to othe...",
  "description": "An authenticated user can create a link with reflected Javascript code inside it for graphs\u2019 page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.",
  "published": "2022-03-09T20:15:08Z",
  "severity": "medium",
  "cvss": 4.4,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.01222,
  "epssPercentile": 0.6889,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "zabbix",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:6.0.7\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2022-24919",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-24919",
      "released": "2022-03-09T20:15:08Z"
    },
    {
      "platform": "linux",
      "product": "zabbix",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:6.0.7\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2022-24919",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-24919",
      "released": "2022-03-09T20:15:08Z"
    },
    {
      "platform": "linux",
      "product": "zabbix",
      "release": "Debian 14",
      "fixedVersion": "1:6.0.7\u002Bdfsg-2",
      "fix": "DEBIAN-CVE-2022-24919",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-24919",
      "released": "2022-03-09T20:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}