VulnerabilityModified

CVE-2022-24918

The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

MEDIUM 4.4EPSS 1.16%

Does this matter?

Lower severity and a low EPSS score (1.16%). Track it; it rarely justifies an emergency change on its own.

Description

An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks.

CVSS 3.1: 4.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.16% probability · 67th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: zabbix/frontend · fedoraproject/fedora
Source: security@zabbix.com

EPSS trend

EPSS 1.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.