CVE-2010-2790: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filterset, (2) showdetails, (3) filterrst, or (4) txtselect parameters to the triggers page (trstatus.php). NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2790?
CVE-2010-2790 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2010-2790?
To fix CVE-2010-2790, upgrade your Zabbix installation to version 1.8.3rc1 or later.
What versions of Zabbix are affected by CVE-2010-2790?
CVE-2010-2790 affects Zabbix versions 1.1 through 1.8.2, including various beta releases.
What type of attack does CVE-2010-2790 enable?
CVE-2010-2790 enables remote attackers to perform cross-site scripting (XSS) attacks, allowing injection of arbitrary web scripts.
Is there a workaround for CVE-2010-2790 if I cannot upgrade?
While upgrading is the best solution, implementing input validation for the affected parameters may serve as a temporary workaround.