Zabbix: Schwachstelle ermöglicht Cross-Site Scripting

Summary

Product

Vulnerabilities 1

• Medium 5.5
  CVE-2024-22119

  Stored XSS in graph items select form

  The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.

  Zabbix Zabbix zabbix zabbix Debian Ubuntu
  Feb 9, 2024

Revision history

1. 2024-10-03 #4

   Neue Updates von Debian aufgenommen

2. 2024-04-28 #3

   Neue Updates von Debian aufgenommen

3. 2024-03-13 #2

   Neue Updates von SUSE aufgenommen

4. 2024-02-08 #1

   Initiale Fassung

References

• SUSE Security Update SUSE-SU-2024:0862-1 vom 2024-03-13
  https://lists.suse.com/pipermail/sle-security-updates/2024-March/018158.html
• ZABBIX BUGS AND ISSUES ZBX-24070 vom 2024-02-09
  https://support.zabbix.com/browse/ZBX-24070
• Github Advisory
  https://github.com/advisories/GHSA-8w8q-863g-6gx9
• Debian Security Advisory DLA-3798 vom 2024-04-28
  https://lists.debian.org/debian-lts-announce/2024/04/msg00020.html
• Debian Security Advisory DLA-3909 vom 2024-10-03
  https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html