CVE-2023-32725 Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.
Attackers can steal session cookies via URL widgets in scheduled reports, allowing unauthorized access to the Zabbix frontend as the victim.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-32725?
CVE-2023-32725 is a critical vulnerability in Zabbix, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
Weakness: CWE-565
Which versions are affected by CVE-2023-32725?
It affects 2 products.
Products include Zabbix Frontend, Zabbix Zabbix Server.
How do I fix CVE-2023-32725?
Apply the vendor's patch.
Is CVE-2023-32725 being exploited?
There is no known exploitation of CVE-2023-32725 in the wild and no public exploit code.
Other vulnerabilities in Zabbix
- CVE-2025-27232 Frontend arbitrary file read in oauth.authorize action
- CVE-2023-29457 Insufficient validation of Action form input fields
- CVE-2025-49643 Frontend DoS vulnerability due to asymmetric resource consumption
- CVE-2023-29456 Inefficient URL schema validation
- CVE-2023-29454 Persistent XSS in the user form
Sources
Also known as DEBIAN-CVE-2023-32725.