Low severity3.7NVD Advisory· Published Mar 9, 2022· Updated Jun 17, 2026
CVE-2022-24918
CVE-2022-24918
Description
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- osv-coords2 versionspkg:rpm/suse/zabbix&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/zabbix&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5
< 4.0.12-4.15.2+ 1 more
- (no CPE)range: < 4.0.12-4.15.2
- (no CPE)range: < 4.0.12-4.15.2
- Zabbix/Frontendv5Range: 5.0.0-5.0.20
Patches
Vulnerability mechanics
References
5- support.zabbix.com/browse/ZBX-20680nvdIssue TrackingPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2024/10/msg00000.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/nvd
News mentions
0No linked articles in our index yet.