Skip to content
OpenAdvisories
Medium WID-SEC-2023-1753 7 CVEs

Zabbix: Mehrere Schwachstellen

Published Jul 13, 2023 · Updated Nov 18, 2025 · Revision 4 · de-DE

Vendor: Debian Vendor: Zabbix Product: Linux Product: Zabbix Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zabbix ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um einen Denial of Service Zustand herbeizuführen und um nicht näher beschriebene Auswirkungen zu verursachen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 7

  • Medium 6.3
    CVE-2023-29457

    Insufficient validation of Action form input fields

    Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of m…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 5.9
    CVE-2023-29458

    Duktape 2.6 bug crashes JavaScript putting too many values in valstack.

    Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 5.7
    CVE-2023-29456

    Inefficient URL schema validation

    URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 5.5
    CVE-2023-29452 EPSS 64%

    Remove possibility to add html into Geomap attribution field

    Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

    Zabbix Zabbix zabbix Debian
  • Medium 5.4
    CVE-2023-29454

    Persistent XSS in the user form

    Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentio…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 5.4
    CVE-2023-29455

    Reflected XSS in several fields of graph form

    Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 4.7
    CVE-2023-29451

    Denial of service caused by a bug in the JSON parser

    Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.

    Zabbix Zabbix zabbix Debian

Revision history

  1. #4

    Referenz(en) aufgenommen: ZBX-22859

  2. #3

    Neue Updates von Debian aufgenommen

  3. #2

    Neue Updates von Debian aufgenommen

  4. #1

    Initiale Fassung

References