CVE-2023-29452 Remove possibility to add html into Geomap attribution field

Medium 5.5 Published 13 Jul 2023 Updated 22 Oct 2024

Attackers can inject HTML into the Geomap attribution field, potentially leading to cross-site scripting attacks in Zabbix.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-29452?

CVE-2023-29452 is a medium-severity cross-site scripting vulnerability in Zabbix Zabbix, published on 13 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

Weakness: CWE-79, CWE-20

Which versions are affected by CVE-2023-29452?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2023-29452?

Apply the vendor's patch.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-29452 being exploited?

There is no known exploitation of CVE-2023-29452 in the wild and no public exploit code.

All Zabbix Zabbix vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-29452, GHSA-3r46-m7qj-9cf6.