CVE-2020-15803 Cross-site scripting in n/a

Medium 6.1 Published 17 Jul 2020 Updated 4 Aug 2024

Attackers can inject malicious scripts into the URL Widget, potentially stealing user sessions or executing code in victim browsers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-15803?

CVE-2020-15803 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 17 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.

Weakness: CWE-79

Which versions are affected by CVE-2020-15803?

It affects 5 products.

Linux distribution packages (2)

`zabbix` SUSE:Linux Enterprise Server 12 SP5	All versions	`4.0.12-4.7.1`
`zabbix` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`4.0.12-4.7.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Backports, Opensuse Leap, Zabbix Zabbix.

How do I fix CVE-2020-15803?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-15803 being exploited?

There is no known exploitation of CVE-2020-15803 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-15803, DLA-2311-1, GHSA-79cm-2gxq-7x9r, SUSE-SU-2020:2251-1, UBUNTU-CVE-2020-15803.