CVE-2023-29455 Reflected XSS in several fields of graph form
Attackers can execute malicious scripts in victims' browsers via reflected XSS in Zabbix graph forms, potentially leading to session hijacking or data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29455?
CVE-2023-29455 is a medium-severity cross-site scripting vulnerability in Zabbix, published on 13 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.
Which versions are affected by CVE-2023-29455?
It affects 1 product.
Products include Zabbix Frontend.
How do I fix CVE-2023-29455?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-29455 being exploited?
There is no known exploitation of CVE-2023-29455 in the wild and no public exploit code.
Other vulnerabilities in Zabbix
- CVE-2023-32725 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
- CVE-2025-27232 Frontend arbitrary file read in oauth.authorize action
- CVE-2023-29457 Insufficient validation of Action form input fields
- CVE-2025-49643 Frontend DoS vulnerability due to asymmetric resource consumption
- CVE-2023-29456 Inefficient URL schema validation
Sources
Also known as DEBIAN-CVE-2023-29455, GHSA-qvwc-px27-9hw9, UBUNTU-CVE-2023-29455.