CVE-2023-29454: Persistent XSS in the user form
First published: Thu Jul 13 2023(Updated: )
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
Credit: security@zabbix.com security@zabbix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zabbix Frontend | >=6.0.0<=6.0.16 | |
| Zabbix Frontend | >=5.0.0<=5.0.33 | |
| Zabbix Frontend | >=4.0.0<=4.0.45 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-29454?
CVE-2023-29454 is a vulnerability that allows an attacker to execute malicious scripts in a web application.
What is stored or persistent cross-site scripting (XSS)?
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends a payload to the web application, which is then saved and unintentionally executed by the application for every victim that interacts with the vulnerable page.
How does CVE-2023-29454 work?
CVE-2023-29454 works by exploiting a web application vulnerability that allows the injection and execution of malicious scripts, which can lead to unauthorized access, data theft, or other security risks.
Which versions of Zabbix Frontend are affected by CVE-2023-29454?
Versions 4.0.0 to 4.0.45, 5.0.0 to 5.0.33, and 6.0.0 to 6.0.16 of Zabbix Frontend are affected by CVE-2023-29454.
How severe is CVE-2023-29454?
CVE-2023-29454 has a severity rating of medium with a CVSS score of 5.4.
How can CVE-2023-29454 be remediated?
To remediate CVE-2023-29454, it is recommended to update Zabbix Frontend to a patched version as per the vendor's advisory and follow best practices for secure coding to prevent XSS vulnerabilities.
Are there any references for CVE-2023-29454?
Yes, you can find more information about CVE-2023-29454 in the following references: [Zabbix support ticket](https://support.zabbix.com/browse/ZBX-22985) and [Debian LTS announcement](https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html).
- collector/nvd-latest
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/title
- agent/first-publish-date
- agent/event
- vendor/zabbix
- canonical/zabbix frontend
- version/zabbix frontend/6.0.0
- version/zabbix frontend/6.0.16
- version/zabbix frontend/5.0.0
- version/zabbix frontend/5.0.33
- version/zabbix frontend/4.0.0
- version/zabbix frontend/4.0.45