Summary
It was discovered that Zabbix incorrectly handled input data in the
discovery and graphs pages. A remote authenticated attacker could possibly
use this issue to perform reflected cross-site scripting (XSS) attacks.
(CVE-2022-35229, CVE-2022-35230)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | zabbix | 1:2.2.2+dfsg-1ubuntu1+esm5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | zabbix | 1:3.0.12+dfsg-1ubuntu0.1~esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | zabbix | 1:4.0.17+dfsg-1ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | zabbix | 1:5.0.17+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Low 3.7
Reflected XSS in discovery page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to…
-
Low 3.7
Reflected XSS in graphs page of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to pr…