Vulnerability · Published Jul 13, 2023 · Assigned by Zabbix
CVE-2023-29454Persistent XSS in the user form
Medium 5.4
In plain English
A medium-severity improper input validation in Zabbix from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zabbix | no fix listed | DEBIAN-CVE-2023-29454 |
| Debian:13 | zabbix | 1:6.0.23+dfsg-1 | DEBIAN-CVE-2023-29454 |
| Debian:14 | zabbix | 1:6.0.23+dfsg-1 | DEBIAN-CVE-2023-29454 |
| Ubuntu:25.10 | zabbix | no fix listed | UBUNTU-CVE-2023-29454 |
| Ubuntu:26.04:LTS | zabbix | no fix listed | UBUNTU-CVE-2023-29454 |
| Ubuntu:26.10 | zabbix | no fix listed | UBUNTU-CVE-2023-29454 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N