title: Possible view of the setup pages by unauthenticated users if config file already exists
description: After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
problem types: CWE-284 Improper Access Control
affected:
{
product: Frontend
vendor: Zabbix
versions:
status: affected, version: 5.4.0 - 5.4.8
lessThan: 5.4.9*, status: unaffected, version: 5.4.9, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
solutions: To remediate this vulnerability, apply the updates or if an immediate update is not possible, follow the presented workarounds.
workarounds: If an immediate update is not possible, please remove the setup.php file