Описание
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needs-triage |
| devel | not-affected | 1:6.0.29+dfsg-1 |
| esm-apps/bionic | released | 1:3.0.12+dfsg-1ubuntu0.1~esm4 |
| esm-apps/focal | released | 1:4.0.17+dfsg-1ubuntu0.1~esm2 |
| esm-apps/jammy | released | 1:5.0.17+dfsg-1ubuntu0.1~esm1 |
| esm-apps/xenial | released | 1:2.4.7+dfsg-2ubuntu2.1+esm4 |
| esm-infra-legacy/trusty | released | 1:2.2.2+dfsg-1ubuntu1+esm5 |
| focal | ignored | end of standard support, was needed |
| impish | ignored | end of life |
| jammy | needed |
Показывать по
EPSS
3.5 Low
CVSS2
3.7 Low
CVSS3
Связанные уязвимости
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
An authenticated user can create a link with reflected Javascript code ...
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Уязвимость универсальной системы мониторинга Zabbix, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
EPSS
3.5 Low
CVSS2
3.7 Low
CVSS3