{"vulnerability": "cve-2022-23131", "sightings": [{"uuid": "a414b69c-0f16-4095-b355-ca735433a9f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "7196f69b-20a0-4733-bc57-4e4bc0361500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971263", "content": "", "creation_timestamp": "2024-12-24T20:26:41.918333Z"}, {"uuid": "c881c321-5aa6-4825-aa65-ddfe6f5a9b99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:35.000000Z"}, {"uuid": "5b9a0d07-d0f5-498c-a4a6-8545f751ba33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://threatintel.cc/2025/09/23/cisa-warns-of-attacks-exploiting.html", "content": "", "creation_timestamp": "2025-09-23T11:47:00.000000Z"}, {"uuid": "b439f557-d0f9-486b-b05b-42ddec5d399c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/af44b085-9a00-4c2c-ab8c-8387cce1be46", "content": "", "creation_timestamp": "2026-02-02T12:28:22.515995Z"}, {"uuid": "314bf3f2-b1e2-4b8d-8c86-e82dfdd927ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://t.me/cKure/8851", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 CISA Alerts on Actively Exploited Flaws in Zabbix; an open-source Network Monitoring Platform.\n\n\u25aa\ufe0eCVE-2022-23131: Zabbix Frontend Authentication Bypass Vulnerability.\n\n\u25aa\ufe0eCVE-2022-23134: Zabbix Frontend Improper Access Control Vulnerability.\n\nhttps://www.cisa.gov/uscert/ncas/current-activity/2022/02/22/cisa-adds-two-known-exploited-vulnerabilities-catalog\n\nhttps://thehackernews.com/2022/02/cisa-alerts-on-actively-exploited-flaws.html", "creation_timestamp": "2022-02-24T16:05:51.000000Z"}, {"uuid": "6a15b000-29fe-4bc5-9148-17f8a2f7c7f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8904", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 \ud83d\udce2 CVE-2022-23131: Zabbix Frontend Authentication Bypass Vulnerability.\n\nhttps://securityonline.info/cve-2022-23131-zabbix-frontend-authentication-bypass-vulnerability/", "creation_timestamp": "2022-03-01T05:19:42.000000Z"}, {"uuid": "ce7b7292-31b3-45ee-bef4-d3309520c001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1826", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-23131\u6f0f\u6d1e\u5229\u7528\u5de5\u5177\u5f00\u7bb1\u5373\u7528\u3002\nURL\uff1ahttps://github.com/Kazaf6s/CVE-2022-23131-\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-02T18:20:12.000000Z"}, {"uuid": "8ca479e7-3362-4514-b968-8b3dd7e638ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1828", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1e\u5229\u7528\n\u63cf\u8ff0\uff1aCVE-2022-23131\u6f0f\u6d1e\u5229\u7528\u5de5\u5177\u5f00\u7bb1\u5373\u7528\u3002\nURL\uff1ahttps://github.com/Kazaf6s/CVE-2022-23131\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1e\u5229\u7528", "creation_timestamp": "2022-04-02T18:43:18.000000Z"}, {"uuid": "86c05671-3d3f-4074-9ae4-aa8d4d46b193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1827", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1e\u5229\u7528\n\u63cf\u8ff0\uff1aCVE-2022-23131\u6f0f\u6d1e\u5229\u7528\u5de5\u5177\u5f00\u7bb1\u5373\u7528\u3002\nURL\uff1ahttps://github.com/Kazaf6s/CVE-2020-23131\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1e\u5229\u7528", "creation_timestamp": "2022-04-02T18:32:38.000000Z"}, {"uuid": "6fba212d-b723-4f18-8843-c0bf82b9ec63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/3078", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aZabbix-SAML-Bypass: CVE-2022-23131\nURL\uff1ahttps://github.com/Vulnmachines/Zabbix-CVE-2022-23131\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-10-01T14:29:03.000000Z"}, {"uuid": "e93b3ff4-aadd-472b-81b8-362e42afe41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2755", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-23131\u6f0f\u6d1e\u6279\u91cf\u68c0\u6d4b\u4e0e\u5229\u7528\u811a\u672c\nURL\uff1ahttps://github.com/1324132494/CVE-2022-23131poc-exp-zabbix-\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-07-22T05:53:29.000000Z"}, {"uuid": "80119f93-a448-4f34-9d2b-03e73e7a3dcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/AGENTZSECURITY/1251", "content": "https://github.com/SirAppSec/nuclei-template-generator-log4j\nhttps://github.com/Str1am/my-nuclei-templates\nhttps://github.com/SumedhDawadi/Custom-Nuclei-Template\nhttps://github.com/SumedhDawadi/Nuclei_Template_Subdomain_Takeover\nhttps://github.com/System00-Security/backflow\nhttps://github.com/T4t4ru/nuclei-templates\nhttps://github.com/Tykerdestroy/Bug-bounty-custom-templates\nhttps://github.com/UnaPibaGeek/honeypots-detection\nhttps://github.com/V0idC0de/dir-listing-iis-test\nhttps://github.com/VulnExpo/nuclei-templates\nhttps://github.com/W01fh4cker/nucleiTemplatesClassifier\nhttps://github.com/YashVardhanTrip/nuclei-templates\nhttps://github.com/adampielak/nuclei-templates\nhttps://github.com/aels/CVE-2022-37042\nhttps://github.com/ahmedalroky/nuclei-templates\nhttps://github.com/akincibor/CVE-2022-27925\nhttps://github.com/al4xs/nuclei-templates\nhttps://github.com/alexrydzak/rydzak-nuclei-templates\nhttps://github.com/am0nt31r0/custom-nuclei-templates\nhttps://github.com/anmolksachan/nuclei-templates\nhttps://github.com/attacker-codeninja/My-Nuclei-Templates-2\nhttps://github.com/ayadim/Nuclei-bug-hunter\nhttps://github.com/b4dboy17/badboy_17-Nuclei-Templates-Collection\nhttps://github.com/badboy-sft/badboy_17-Nuclei-Templates-Collection\nhttps://github.com/badboycxcc/CVE-2023-24100\nhttps://github.com/baharebenesbordi/Nuclei-Templates\nhttps://github.com/bhataasim1/PersonalTemplates\nhttps://github.com/binod235/nuclei-templates-and-reports\nhttps://github.com/bjhulst/nuclei-custom-templates\nhttps://github.com/blazeinfosec/nuclei-templates\nhttps://github.com/boobooHQ/private_templates\nhttps://github.com/brinhosa/brinhosa-nuclei-templates\nhttps://github.com/bufferbandit/gitScanNucleiTemplate\nhttps://github.com/bugbountydude/Nuclei-TamplatesBackup\nhttps://github.com/c-sh0/nuclei_templates\nhttps://github.com/c3l3si4n/malicious_nuclei_templates\nhttps://github.com/chouaibhm/foulenzer-templates\nhttps://github.com/cipher387/juicyinfo-nuclei-templates\nhttps://github.com/clarkvoss/Nuclei-Templates\nhttps://github.com/coldrainh/nuclei-ByMyself\nhttps://github.com/compr00t/nuclei-templates\nhttps://github.com/d3sca/Nuclei_Templates\nhttps://github.com/daffainfo/my-nuclei-templates\nhttps://github.com/damon-sec/Nuclei-templates-Collection\nhttps://github.com/damon-sec/TCSZ-Nuclei\nhttps://github.com/dk4trin/templates-nuclei\nhttps://github.com/drfabiocastro/certwatcher-templates\nhttps://github.com/e1abrador/SpringCorePoC.sh\nhttps://github.com/ed-red/redmc_custom_templates_nuclei\nhttps://github.com/ekinsb/Nuclei-Templates\nhttps://github.com/emadshanab/nucleiDB\nhttps://github.com/erickfernandox/nuclei-templates\nhttps://github.com/esetal/nuclei-bb-templates\nhttps://github.com/ethicalhackingplayground/erebus-templates\nhttps://github.com/fostane/my-nuclei-templates-1\nhttps://github.com/geeknik/nuclei-templates-1\nhttps://github.com/geeknik/the-nuclei-templates\nhttps://github.com/glyptho/templatesallnuclei\nhttps://github.com/h4ndsh/nuclei-templates\nhttps://github.com/ibaiw/nuclei_templates\nhttps://github.com/im403/nuclei-temp\nhttps://github.com/imhunterand/nuclei-custom-templates\nhttps://github.com/javaongsan/nuclei-templates\nhttps://github.com/justmumu/SpringShell\nhttps://github.com/k00kx/nuclei-templates\nhttps://github.com/kaanatmacaa/CVE-2024-23897\nhttps://github.com/kabilan1290/templates\nhttps://github.com/kernel-krunch/nuclei-templates\nhttps://github.com/kh4sh3i/CVE-2022-23131\nhttps://github.com/kh4sh3i/Nextcloud-Pentesting\nhttps://github.com/kh4sh3i/Webmin-CVE\nhttps://github.com/learnerboy88/CVE-2023-29489\nhttps://github.com/lliwi/nuclei-repo-hunter\nhttps://github.com/luck-ying/Library-YAML-POC\nhttps://github.com/manasmbellani/nuclei-templates\nhttps://github.com/marcositu/nuclei-custom-templates\nhttps://github.com/mastersir-lab/nuclei-yaml-poc\nhttps://github.com/mbskter/Masscan2Httpx2Nuclei-Xray", "creation_timestamp": "2025-04-22T02:52:21.000000Z"}, {"uuid": "07a169c6-21e4-4a76-ac50-a46a12696a5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/AGENTZSECURITY/1248", "content": "https://github.com/meme-lord/Custom-Nuclei-Templates\nhttps://github.com/Akokonunes/Private-Nuclei-Templates\nhttps://github.com/rafaelwdornelas/my-nuclei-templates\nhttps://github.com/rafaelcaria/Nuclei-Templates\nhttps://github.com/panch0r3d/nuclei-templates\nhttps://github.com/0x727/ObserverWard_0x727\nhttps://github.com/ethicalhackingplayground/erebus-templates\nhttps://github.com/test502git/log4j-fuzz-head-poc\nhttps://github.com/Str1am/my-nuclei-templates\nhttps://github.com/d3sca/Nuclei_Templates\nhttps://github.com/c-sh0/nuclei_templates\nhttps://github.com/glyptho/templatesallnuclei\nhttps://github.com/0xAwali/Virtual-Host\nhttps://github.com/praetorian-inc/chariot-launch-nuclei-templates\nhttps://github.com/brinhosa/brinhosa-nuclei-templates\nhttps://github.com/kh4sh3i/CVE-2022-23131\nhttps://github.com/wr00t/templates\nhttps://github.com/alexrydzak/rydzak-nuclei-templates\nhttps://github.com/adampielak/nuclei-templates\nhttps://github.com/ShangRui-hash/my-nuclei-templates\nhttps://github.com/dk4trin/templates-nuclei\nhttps://github.com/Elsfa7-110/mynuclei-templates\nhttps://github.com/ping-0day/template\nhttps://github.com/wasp76b/nuclei-templates\nhttps://github.com/th3r4id/nuclei-templates\nhttps://github.com/justmumu/SpringShell\nhttps://github.com/trickest/log4j\nhttps://github.com/toramanemre/apache-solr-log4j-CVE-2021-44228\nhttps://github.com/toramanemre/log4j-rce-detect-waf-bypass\nhttps://github.com/blazeinfosec/nuclei-templates\nhttps://github.com/ekinsb/Nuclei-Templates\nhttps://github.com/KeepHowling/all_freaking_nuclei_templates\nhttps://github.com/Odayex/Random-Nuclei-Templates\nhttps://github.com/aels/CVE-2022-37042\nhttps://github.com/tamimhasan404/Open-Source-Nuclei-Templates-Downloader\nhttps://github.com/pentest-dev/Profesional-Nuclei-Templates\nhttps://github.com/badboy-sft/badboy_17-Nuclei-Templates-Collection\nhttps://github.com/NightRang3r/misc_nuclei_templates\nhttps://github.com/ExpLangcn/NucleiTP\nhttps://github.com/0xmaximus/final_freaking_nuclei_templates\nhttps://github.com/Jagomeiister/nuclei-templates\nhttps://github.com/ricardomaia/nuclei-template-generator-for-wordpress-plugins\nhttps://github.com/Lopseg/nuclei-c-templates\nhttps://github.com/sl4x0/NC-Templates\nhttps://github.com/thecyberneh/nuclei-templatess\nhttps://github.com/yarovit-developer/nuclei-templates\nhttps://github.com/cipher387/juicyinfo-nuclei-templates\nhttps://github.com/Kaue-Navarro/Templates-kaue-nuclei\nhttps://github.com/JoshMorrison99/url-based-nuclei-templates\nhttps://github.com/ayadim/Nuclei-bug-hunter\nhttps://github.com/soumya123raj/Nuclei\nhttps://github.com/soapffz/myown-nuclei-poc\nhttps://github.com/zer0yu/Open-PoC\nhttps://github.com/SumedhDawadi/Custom-Nuclei-Template\nhttps://github.com/coldrainh/nuclei-ByMyself\nhttps://github.com/binod235/nuclei-templates-and-reports\nhttps://github.com/mbskter/Masscan2Httpx2Nuclei-Xray\nhttps://github.com/luck-ying/Library-YAML-POC\nhttps://github.com/PedroFerreira97/nuclei_templates\nhttps://github.com/Hunt2behunter/nuclei-templates\nhttps://github.com/mastersir-lab/nuclei-yaml-poc\nhttps://github.com/SirAppSec/nuclei-template-generator-log4j\nhttps://github.com/0xPugazh/my-nuclei-templates\nhttps://github.com/topscoder/nuclei-wordfence-cve\nhttps://github.com/erickfernandox/nuclei-templates\nhttps://github.com/damon-sec/Nuclei-templates-Collection\nhttps://github.com/DoubleTakes/nuclei-templates\nhttps://github.com/ptyspawnbinbash/template-enhancer\nhttps://github.com/Arvinthksrct/alltemplate\nhttps://github.com/srkgupta/cent-nuclei-templates\nhttps://github.com/UltimateSec/ultimaste-nuclei-templates\nhttps://github.com/xinZa1/template\nhttps://github.com/SirBugs/Priv8-Nuclei-Templates\nhttps://github.com/davidfortytwo/GetNucleiTemplates\nhttps://github.com/v3l4r10/Nuclei-Templates\nhttps://github.com/wearetyomsmnv/llm_integrated_nuclei_templates", "creation_timestamp": "2025-04-22T02:52:21.000000Z"}, {"uuid": "4166cb9a-7aad-4c01-a28b-b0979d6b33da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://t.me/AGENTZSECURITY/1243", "content": "https://github.com/pikpikcu/nuclei-templates\nhttps://github.com/esetal/nuclei-bb-templates\nhttps://github.com/ARPSyndicate/kenzer-templates\nhttps://github.com/medbsq/ncl\nhttps://github.com/notnotnotveg/nuclei-custom-templates\nhttps://github.com/foulenzer/foulenzer-templates\nhttps://github.com/clarkvoss/Nuclei-Templates\nhttps://github.com/z3bd/nuclei-templates\nhttps://github.com/joanbono/nuclei-templates\nhttps://github.com/peanuth8r/Nuclei_Templates\nhttps://github.com/thebrnwal/Content-Injection-Nuclei-Script\nhttps://github.com/ree4pwn/my-nuclei-templates\nhttps://github.com/im403/nuclei-temp\nhttps://github.com/System00-Security/backflow\nhttps://github.com/geeknik/nuclei-templates-1\nhttps://github.com/geeknik/the-nuclei-templates\nhttps://github.com/optiv/mobile-nuclei-templates\nhttps://github.com/obreinx/nuceli-templates\nhttps://github.com/randomstr1ng/nuclei-sap-templates\nhttps://github.com/CharanRayudu/Custom-Nuclei-Templates\nhttps://github.com/zinminphyo0/KozinTemplates\nhttps://github.com/n1f2c3/mytemplates\nhttps://github.com/kabilan1290/templates\nhttps://github.com/smaranchand/nuclei-templates\nhttps://github.com/Saimonkabir/Nuclei-Templates\nhttps://github.com/yavolo/nuclei-templates\nhttps://github.com/sadnansakin/my-nuclei-templates\nhttps://github.com/5cr1pt/templates\nhttps://github.com/rahulkadavil/nuclei-templates\nhttps://github.com/Nithissh0708/Custom-Nuclei-Templates\nhttps://github.com/shifa123/detections\nhttps://github.com/daffainfo/my-nuclei-templates\nhttps://github.com/javaongsan/nuclei-templates\nhttps://github.com/AshiqurEmon/nuclei_templates.git\nhttps://github.com/ChiaraNRTT96/BountySkill\nhttps://gist.github.com/ResistanceIsUseless/e46848f67706a8aa1205c9d2866bff31\nhttps://gist.github.com/0x240x23elu\nhttps://github.com/NitinYadav00/My-Nuclei-Templates\nhttps://github.com/sharathkramadas/k8s-nuclei-templates\nhttps://github.com/securitytest3r/nuclei_templates_work\nhttps://github.com/MR-pentestGuy/nuclei-templates\nhttps://github.com/thelabda/nuclei-templates\nhttps://github.com/1in9e/my-nuclei-templates\nhttps://github.com/redteambrasil/nuclei-templates\nhttps://github.com/Saptak9983/Nuclei-Template\nhttps://github.com/Harish4948/Nuclei-Templates\nhttps://github.com/R-s0n/Custom_Vuln_Scan_Templates\nhttps://github.com/meme-lord/Custom-Nuclei-Templates\nhttps://github.com/rafaelcaria/Nuclei-Templates\nhttps://github.com/panch0r3d/nuclei-templates\nhttps://github.com/0x727/ObserverWard_0x727\nhttps://github.com/ethicalhackingplayground/erebus-templates\nhttps://github.com/test502git/log4j-fuzz-head-poc\nhttps://github.com/Str1am/my-nuclei-templates\nhttps://github.com/d3sca/Nuclei_Templates\nhttps://github.com/c-sh0/nuclei_templates\nhttps://github.com/glyptho/templatesallnuclei\nhttps://github.com/0xAwali/Virtual-Host\nhttps://github.com/praetorian-inc/chariot-launch-nuclei-templates\nhttps://github.com/brinhosa/brinhosa-nuclei-templates\nhttps://github.com/kh4sh3i/CVE-2022-23131\nhttps://github.com/wr00t/templates\nhttps://github.com/alexrydzak/rydzak-nuclei-templates\nhttps://github.com/adampielak/nuclei-templates\nhttps://github.com/ShangRui-hash/my-nuclei-templates\nhttps://github.com/dk4trin/templates-nuclei\nhttps://github.com/Elsfa7-110/mynuclei-templates\nhttps://github.com/ping-0day/templates\nhttps://github.com/wasp76b/nuclei-templates\nhttps://github.com/th3r4id/nuclei-templates\nhttps://github.com/themastersunil/Nuclei-TamplatesBackup.git\nhttps://github.com/justmumu/SpringShell\nhttps://github.com/trickest/log4j\nhttps://github.com/toramanemre/apache-solr-log4j-CVE-2021-44228\nhttps://github.com/toramanemre/log4j-rce-detect-waf-bypass\nhttps://github.com/blazeinfosec/nuclei-templates\nhttps://github.com/ekinsb/Nuclei-Templates\nhttps://github.com/Charseki/nuclei_templates\nhttps://github.com/testtt3424/nuclei-templates\nhttps://github.com/V0idC0de/dir-listing-iis-test", "creation_timestamp": "2025-04-22T02:52:20.000000Z"}, {"uuid": "c969e311-367a-4b74-8196-190facceedc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://t.me/arpsyndicate/1002", "content": "#ExploitObserverAlert\n\nCVE-2022-23131\n\nDESCRIPTION: Exploit Observer has 58 entries related to CVE-2022-23131. In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).\n\nFIRST-EPSS: 0.969280000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-03T18:45:04.000000Z"}, {"uuid": "c677e42c-23dd-40e9-b29c-f21f2d10311b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "Telegram/hCfCsWkJLNX-4ZZS6AKhD47aw1Wu0GxnlvM04EnHwON9-Gg", "content": "", "creation_timestamp": "2025-03-05T22:00:05.000000Z"}, {"uuid": "84c8661c-64d6-4915-bc8f-836ffa9ffa2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "Telegram/aGRchAdBZrssb-k1rTgBgmxMjwWLNORPeM8cAxqMrNH0iF8", "content": "", "creation_timestamp": "2025-02-27T16:00:09.000000Z"}, {"uuid": "83e1f02d-ee8b-4a9d-95a7-d248c04429fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/3476", "content": "https://github.com/r10lab/CVE-2022-23131", "creation_timestamp": "2023-10-26T06:10:31.000000Z"}, {"uuid": "c48b65dc-c813-43da-b6ec-44255a1a2be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://t.me/true_secator/2673", "content": "\u200b\u200b\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 CVE-2022-23131 \u0438 CVE-2022-23134 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e Zabbix - \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u0435\u0442\u0435\u0439, \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0434\u0430\u043d\u043d\u044b\u043c CISA, \u043e\u0434\u043d\u0430 \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u043c\u0435\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 9,1 \u0438\u0437 10.\n\n\u0414\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 SonarSource \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u0432\u00a0\u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435 \u043f\u043e\u0447\u0442\u0438 \u043c\u0435\u0441\u044f\u0446 \u043d\u0430\u0437\u0430\u0434.\n\nCVE-2022-23131 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430 \u0441 Zabbix Frontend. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0435\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c \u044f\u0437\u044b\u043a\u043e\u043c \u0440\u0430\u0437\u043c\u0435\u0442\u043a\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 SAML (\u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0435\u0434\u0438\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (\u0435\u0434\u0438\u043d\u044b\u0439 \u0432\u0445\u043e\u0434), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u043c\u0435\u043d \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u043c \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u0435\u043d\u0438\u0439 \u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u043c \u0443\u0441\u043b\u0443\u0433). \n\n\u0415\u0441\u043b\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f SAML SSO \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 (\u043d\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e), \u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0430\u043d\u0441\u0430 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043b\u043e\u0433\u0438\u043d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0439 \u0432 \u0441\u0435\u0430\u043d\u0441\u0435, \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f.\u00a0\u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 Zabbix.\n\n21 \u0444\u0435\u0432\u0440\u0430\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0432\u0443\u044e\u0449\u0438\u0439 PoC. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u041d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u041d\u0438\u0434\u0435\u0440\u043b\u0430\u043d\u0434\u0430\u0445\u00a0\u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 root.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-23134 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043d\u0435\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0435\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 (\u0441\u043a\u0440\u0438\u043f\u0442 setup.php) \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0430\u043d\u0435\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438\u00a0Zabbix\u00a0\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f (\u0432\u0435\u0440\u0441\u0438\u0438 5.4.9, 5.0.9 \u0438 4.0.37), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0435\u0448\u0430\u044e\u0442 \u043e\u0431\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0447\u0435\u043c, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u0445, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \u0421\u0430\u043c\u0438 \u043e\u0446\u0435\u043d\u0438\u0442\u0435 \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c", "creation_timestamp": "2022-02-25T18:16:00.000000Z"}, {"uuid": "e2d3d29c-0672-4338-9f96-651c110f2454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://t.me/cibsecurity/35414", "content": "\u203c CVE-2022-23131 \u203c\n\nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-01-13T18:18:30.000000Z"}, {"uuid": "0352fc68-42a7-4e7f-b145-b6b9bdb518d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://t.me/thehackernews/1917", "content": "U.S. cybersecurity agency CISA is warning companies about two actively exploited vulnerabilities affecting the widely used open-source Zabbix enterprise monitoring platform.\n\n\u2705 CVE-2022-23131\n\u2705 CVE-2022-23134\n\nDetails: https://thehackernews.com/2022/02/cisa-alerts-on-actively-exploited-flaws.html", "creation_timestamp": "2022-02-24T13:18:32.000000Z"}, {"uuid": "a0e0db64-8083-4586-bc9f-8475005d6d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/1361", "content": "https://github.com/r10lab/CVE-2022-23131\n#github", "creation_timestamp": "2023-10-26T05:23:35.000000Z"}, {"uuid": "e9d3423f-304a-4cb4-8ad8-bca7cf9a159b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5445", "content": "#Threat_Research\n1. Exploiting Jenkins build authorization\nhttps://medium.com/cider-sec/exploiting-jenkins-build-authorization-22bf72926072\n2. CVE-2022-23131 - Zabbix SAML Authentication Bypass\nhttps://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage", "creation_timestamp": "2022-02-19T13:30:24.000000Z"}, {"uuid": "1b9a4413-d9e7-45a6-adc9-4936233eb791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9265", "content": "#exploit\n1. CVE-2023-4069:\nGetting RCE in Chrome with incomplete object initialization in the Maglev compiler\nhttps://github.blog/2023-10-17-getting-rce-in-chrome-with-incomplete-object-initialization-in-the-maglev-compiler\n\n2. CVE-2022-23131:\nZabbix SAML Bypass\nhttps://github.com/Mr-xn/cve-2022-23131\n]-> https://github.com/r10lab/CVE-2022-23131", "creation_timestamp": "2023-10-26T10:59:01.000000Z"}, {"uuid": "e8ef6ba8-8f81-4666-974d-1a85d7631a10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/win_def/100", "content": "\u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 SAML SSO \u0432 Zabbix (CVE-2022-23131)\n\n\u0415\u0441\u043b\u0438 \u0432 \u043f\u0430\u043d\u0435\u043b\u0438 Zabbix \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 SAML SSO (\u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0430) \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0430\u043d\u0441\u0430 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a Zabbix Frontend.\n\n\u0414\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0443\u0436\u043d\u043e \u0437\u043d\u0430\u0442\u044c (\u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u0440\u0430\u0442\u044c) \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f Zabbix \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0433\u043e\u0441\u0442\u0435\u0432\u0443\u044e \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u0412\u0438\u0434\u0435\u043e\n\n\u0421\u0441\u044b\u043b\u043a\u0430 \u043d\u0430  POC\n\n\u0414\u043e\u0440\u043a \u0434\u043b\u044f Shodan:\nhttp.html:zabbix http.html:saml", "creation_timestamp": "2022-02-20T10:36:27.000000Z"}, {"uuid": "42167581-746a-4af3-a029-1e328ee03b64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/Rootsec_2/1546", "content": "#exploit\n1. CVE-2023-4069:\nGetting RCE in Chrome with incomplete object initialization in the Maglev compiler\nhttps://github.blog/2023-10-17-getting-rce-in-chrome-with-incomplete-object-initialization-in-the-maglev-compiler\n\n2. CVE-2022-23131:\nZabbix SAML Bypass\nhttps://github.com/Mr-xn/cve-2022-23131\n]-> https://github.com/r10lab/CVE-2022-23131", "creation_timestamp": "2024-08-16T08:40:07.000000Z"}, {"uuid": "c8c734da-b3c4-4408-b504-a9479b4d3850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/2133", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-23131\nGithub: https://github.com/Vulnmachines/Zabbix-CVE-2022-23131\nDescribe: \nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).", "creation_timestamp": "2026-08-02T00:01:17.755616Z"}, {"uuid": "83e337c3-e994-4b8a-8433-bea03a18e81b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/2133", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-23131\nGithub: https://github.com/Vulnmachines/Zabbix-CVE-2022-23131\nDescribe: \nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).", "creation_timestamp": "2026-08-01T04:00:04.564878Z"}, {"uuid": "02be98d3-4a4f-4ace-8fc6-d0179725f820", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/306a363d-9f00-4b88-9ca9-4c5bf1ef0d0a", "content": "", "creation_timestamp": "2026-06-19T12:47:37.895410Z"}, {"uuid": "6c0cf0ae-8e5c-4568-97a2-8c6c34c0678d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52b03d4c-448f-46e8-b580-2f16aa9154c1", "content": "", "creation_timestamp": "2026-06-23T14:04:57.758283Z"}, {"uuid": "0e201b10-4d3e-4a9a-b27a-e5f74a6b8dc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://t.me/CVEhub/2133", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-23131\nGithub: https://github.com/Vulnmachines/Zabbix-CVE-2022-23131\nDescribe: \nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).", "creation_timestamp": "2026-07-29T12:01:01.615471Z"}, {"uuid": "a45a415d-ab29-4b24-b97f-2200e5fcfe0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://t.me/CVEhub/2133", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-23131\nGithub: https://github.com/Vulnmachines/Zabbix-CVE-2022-23131\nDescribe: \nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).", "creation_timestamp": "2026-07-30T00:01:41.078150Z"}, {"uuid": "391afafa-db01-4a6f-9263-6ecedcb14003", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://t.me/hacking_Attack/43621", "content": "Black Hat Ethical Hacking\nCritical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on serversPost Views: 208 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo vulnerabilities in\u00a0open source\u00a0monitoring platform Zabbix could allow an attacker to bypass authentication and execute arbitrary code on a targeted server.\nThe security flaws were found in Zabbix Web Frontend, a platform used to collect, centralize. and track metrics such as CPU load and network traffic across entire infrastructures.\n\nResearchers from SonarSource, who discovered the bugs, noted that Zabbix is a high-profile target for threat actors due to its popularity, features, and its \u201cprivileged position in most company\u2019s networks\u201d. IssuesThe first vulnerability, tracked as CVE-2022-23131, which was given a severity of 9.1, is unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.\n\nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified.\n\nA malicious unauthenticated actor could exploit this issue to escalate privileges and gain admin access to the Zabbix Frontend.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nA caveat to this is that to perform the attack, SAML authentication is required to be enabled, and the assailant has to know the username of Zabbix user (or use the guest account, which is disabled by default), a security advisory\u00a0from Zabbix notes.\n\nThe second vulnerability found by SonarSource, tracked as CVE-2022-23134, is rated as medium severity and allows some steps of setup.php file to be reachable not only by super-administrators, but by unauthenticated users as well.\n\nA malicious actor could pass step checks and potentially change the configuration of Zabbix Frontend, an advisory notes.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Patch nowIn a blog post from SonarSource, the researchers said that when writing and reviewing code related to important security features, \u201cit is easy to make the same assumptions as the original developer who introduced the vulnerability\u201d.\n\nThey wrote: \u201cHere, there were no integration tests related to the client-side session storage that could have spotted this behavior.\n\n\u201cAlways provide access to sensible services with extended internal accesses (e.g. orchestration, monitoring) over VPNs or a restricted set of IP addresses, harden filesystem permissions to prevent unintended changes, remove setup scripts, etc.\u201d\n\nFinally, the researchers recommended upgrading all instances running a Zabbix Web Frontend to 6.0.0beta2, 5.4.9, 5.0.19, or 4.0.37. See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: How ILOVEYOU worm became the first global computer virus pandemic Source: portswigger.net Source Linkhttps://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:53.555972Z"}, {"uuid": "b2c790bb-eb45-4ffa-8c5f-1cc4bcb76d9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23131", "type": "seen", "source": "https://t.me/hacking_Attack/43621", "content": "Black Hat Ethical Hacking\nCritical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on serversPost Views: 208 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo vulnerabilities in\u00a0open source\u00a0monitoring platform Zabbix could allow an attacker to bypass authentication and execute arbitrary code on a targeted server.\nThe security flaws were found in Zabbix Web Frontend, a platform used to collect, centralize. and track metrics such as CPU load and network traffic across entire infrastructures.\n\nResearchers from SonarSource, who discovered the bugs, noted that Zabbix is a high-profile target for threat actors due to its popularity, features, and its \u201cprivileged position in most company\u2019s networks\u201d. IssuesThe first vulnerability, tracked as CVE-2022-23131, which was given a severity of 9.1, is unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.\n\nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified.\n\nA malicious unauthenticated actor could exploit this issue to escalate privileges and gain admin access to the Zabbix Frontend.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nA caveat to this is that to perform the attack, SAML authentication is required to be enabled, and the assailant has to know the username of Zabbix user (or use the guest account, which is disabled by default), a security advisory\u00a0from Zabbix notes.\n\nThe second vulnerability found by SonarSource, tracked as CVE-2022-23134, is rated as medium severity and allows some steps of setup.php file to be reachable not only by super-administrators, but by unauthenticated users as well.\n\nA malicious actor could pass step checks and potentially change the configuration of Zabbix Frontend, an advisory notes.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Patch nowIn a blog post from SonarSource, the researchers said that when writing and reviewing code related to important security features, \u201cit is easy to make the same assumptions as the original developer who introduced the vulnerability\u201d.\n\nThey wrote: \u201cHere, there were no integration tests related to the client-side session storage that could have spotted this behavior.\n\n\u201cAlways provide access to sensible services with extended internal accesses (e.g. orchestration, monitoring) over VPNs or a restricted set of IP addresses, harden filesystem permissions to prevent unintended changes, remove setup scripts, etc.\u201d\n\nFinally, the researchers recommended upgrading all instances running a Zabbix Web Frontend to 6.0.0beta2, 5.4.9, 5.0.19, or 4.0.37. See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: How ILOVEYOU worm became the first global computer virus pandemic Source: portswigger.net Source Linkhttps://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:07.375441Z"}]}