CVE-2023-29454: Persistent XSS in the user form

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-13 · updated 2026-06-17
Weakness: CWE-20

Description

Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages.

Affected products

Zabbix Frontend: from 4.0.0 through 4.0.45; from 5.0.0 through 5.0.33; from 6.0.0 through 6.0.16

References

https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
https://support.zabbix.com/browse/ZBX-22985
https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
https://support.zabbix.com/browse/ZBX-22985

Get alerted when CVE-2023-29454 or the next vulnerability affects your stack