CVE catalog

CVE-2023-29455

zabbix: CVE-2023-29455

Severity: Medium
Published: Jul 13, 2023, 10:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.60% · Oct 25, 2026

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	zabbix	sid	`1:7.0.29+dfsg-2`	fixed
Debian	zabbix	forky	`1:7.0.29+dfsg-2`	fixed
Debian	zabbix	trixie	`1:7.0.22+dfsg-1~deb13u1`	fixed
Debian	zabbix	bookworm	`1:6.0.14+dfsg-1`	vulnerable
Ubuntu	zabbix	pro	`1:5.0.8+dfsg-1build1`	vulnerable
Ubuntu	zabbix	pro	`1:5.0.14+dfsg-1`	vulnerable
Ubuntu	zabbix	pro	`1:5.0.17+dfsg-1`	vulnerable
Ubuntu	zabbix	pro	`1:5.0.17+dfsg-1ubuntu0.1~esm1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	zabbix	source	sid	`1:6.0.23+dfsg-1`	not yet assigned	Not reported	[1055175]
Debian	zabbix	source	forky	`1:6.0.23+dfsg-1`	not yet assigned	Not reported	[1055175]
Debian	zabbix	source	trixie	`1:6.0.23+dfsg-1`	not yet assigned	Not reported	[1055175]
Debian	zabbix	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1055175]

[Debian bug #1055175]

Notes

[bookworm] zabbix: The WEB UI is only supported for access by trusted users, no security updates issued for it, #1124558

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]