Описание
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain.
A flaw was found in Zabbix. This prototype pollution vulnerability, specifically within the searchParamsToObject() function, allows an attacker to inject malicious data into web pages. By manipulating URL parameters that are not properly filtered, an attacker can achieve persistent Cross-Site Scripting (XSS) in the Maps feature. This could lead to unauthorized execution of scripts in a user's browser, potentially compromising user sessions or disclosing sensitive information.
Отчет
Red Hat rates this vulnerability as Important because an authenticated remote attacker can store arbitrary script payloads within the web interface, which execute in the context of other users and can compromise administrative sessions. Although persistent script injection presents a significant risk to application integrity, Zabbix is not included in Red Hat Enterprise Linux or any supported Red Hat enterprise offerings and is only distributed via community repositories such as Fedora.
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
Prototype pollution vulnerability in searchParamsToObject() is leading ...
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
ALT-PU-2026-14143: package `zabbix` update to version 7.0.30-alt0.p10.1
7.3 High
CVSS3