Описание
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| zabbix | fixed | 1:7.0.9+dfsg-1 | package |
Примечания
https://support.zabbix.com/browse/ZBX-26254
Fixed by: https://github.com/zabbix/zabbix/commit/4c2cf43fade6ea6239f9cba32527a547461bdec9 (7.0.7rc1)
Fixed by (merge commit): https://github.com/zabbix/zabbix/commit/6b98ae293a088183b1c1ba0428664d76f98ef36c (6.0.37rc1)
EPSS
Связанные уязвимости
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Уязвимость веб-интейрфеса универсальной системы мониторинга Zabbix, позволяющая нарушителю провести атаку межсайтового скриптинга
EPSS