{"id":"CVE-2022-40626","details":"An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.","modified":"2026-07-07T08:51:33.134787073Z","published":"2022-09-14T11:15:53.473Z","database_specific":{"unresolved_ranges":[{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"37"},{"last_affected":"37"}],"source":"CPE_STRING"},{"source":"CPE_STRING","vendor_product":"zabbix:zabbix","cpes":["cpe:2.3:a:zabbix:zabbix:6.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2.0"},{"last_affected":"6.2.0"}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPU4RCRYVNVM3SS523UQXE63ATCTEX5G/"},{"type":"FIX","url":"https://support.zabbix.com/browse/ZBX-21350"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zabbix/zabbix","events":[{"introduced":"5203d2ea7d901cd33d148f20586e2155901a7faa"},{"last_affected":"3f7597e3ea34ace89bdcb6b907c353ec27801550"}],"database_specific":{"cpe":"cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"6.0.0"},{"last_affected":"6.0.6"}],"source":"CPE_RANGE"}}],"versions":["6.0.1","6.0.6","6.0.6rc1","6.0.5","6.0.5rc1","6.0.4","6.0.4rc1","6.0.3","6.0.3rc1","6.0.2","6.0.2rc1","6.0.1rc4","6.0.1rc3","6.0.1rc2","6.0.1rc1","6.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-40626.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}