CVE-2023-29457

2023-07-1310:15:09

CWE-79

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-29457

reflected xss

web application security

nvd

vulnerability

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim’s browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts.

Affected configurations

NVD

Node

zabbixfrontendRange4.0.0–4.0.45

zabbixfrontendRange5.0.0–5.0.34

zabbixfrontendRange6.0.0–6.0.17

CPENameOperatorVersion
zabbix:frontendzabbix frontendle4.0.45
zabbix:frontendzabbix frontendle5.0.34
zabbix:frontendzabbix frontendle6.0.17

CPE	Name	Operator	Version
zabbix:frontend	zabbix frontend	le	4.0.45
zabbix:frontend	zabbix frontend	le	5.0.34
zabbix:frontend	zabbix frontend	le	6.0.17

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Frontend"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "changes": [
          {
            "at": "4.0.46rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.0.45",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "5.0.35rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.0.34",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.0.18rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.17",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "git"
      }
    ]
  }
]