CVE-2023-29454: Persistent XSS in the user form
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-29454?
CVE-2023-29454 is a vulnerability that allows an attacker to execute malicious scripts in a web application.
What is stored or persistent cross-site scripting (XSS)?
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends a payload to the web application, which is then saved and unintentionally executed by the application for every victim that interacts with the vulnerable page.
How does CVE-2023-29454 work?
CVE-2023-29454 works by exploiting a web application vulnerability that allows the injection and execution of malicious scripts, which can lead to unauthorized access, data theft, or other security risks.
Which versions of Zabbix Frontend are affected by CVE-2023-29454?
Versions 4.0.0 to 4.0.45, 5.0.0 to 5.0.33, and 6.0.0 to 6.0.16 of Zabbix Frontend are affected by CVE-2023-29454.
How severe is CVE-2023-29454?
CVE-2023-29454 has a severity rating of medium with a CVSS score of 5.4.
How can CVE-2023-29454 be remediated?
To remediate CVE-2023-29454, it is recommended to update Zabbix Frontend to a patched version as per the vendor's advisory and follow best practices for secure coding to prevent XSS vulnerabilities.
Are there any references for CVE-2023-29454?
Yes, you can find more information about CVE-2023-29454 in the following references: [Zabbix support ticket](https://support.zabbix.com/browse/ZBX-22985) and [Debian LTS announcement](https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html).