CVE-2020-15803
Published: 17 July 2020
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.
From the Ubuntu Security Team
It was discovered that Zabbix did not properly validate input. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
zabbix Launchpad, Ubuntu, Debian |
bionic |
Released
(1:3.0.12+dfsg-1ubuntu0.1~esm2)
Available with Ubuntu Pro |
| focal |
Released
(1:4.0.17+dfsg-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
| groovy |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| hirsute |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| impish |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| jammy |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| kinetic |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| lunar |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| mantic |
Not vulnerable
(1:5.0.2+dfsg-1)
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(1:2.4.7+dfsg-2ubuntu2.1+esm2)
Available with Ubuntu Pro |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |