Critical · published January 13, 2022
CVSS calls it critical at 9.1. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A crafty unauthenticated actor can modify session data when SAML SSO is enabled, potentially gaining admin access to your Zabbix Frontend. 🔥 Think of it like an uninvited guest slipping into a party because they found a way to change their name badge, allowing them to mingle with the VIPs without raising any alarms. If exploited, this vulnerability could lead to complete control over your Zabbix instance—an attacker could modify settings, access sensitive information, or even shut down critical monitoring services. This is absolutely devastating for any organization relying on Zabbix to keep tabs on their IT environment!
Think of it like an uninvited guest slipping into a party because they found a way to change their name badge, allowing them to mingle with the VIPs without raising any alarms. The flaw exists due to the lack of verification on the user login stored in the session data when SAML authentication is enabled. This allows an attacker to escalate privileges by manipulating session data, resulting in unauthorized access.
If exploited, this vulnerability could lead to complete control over your Zabbix instance—an attacker could modify settings, access sensitive information, or even shut down critical monitoring services. This is absolutely devastating for any organization relying on Zabbix to keep tabs on their IT environment! To protect against this, ensure that SAML SSO is not enabled unless absolutely necessary. If it must be enabled, implement strict validation checks on session data and regularly audit user permissions. Always keep your Zabbix installation updated to the latest version to mitigate risks! You've got this! Follow these steps, and your Zabbix instance will be secure in no time. 🛡️