Lucene search
HistoryDec 18, 2023 - 10:15 a.m.
CVE-2023-32725
website security
session cookie
frontend access
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
39.1%
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
Affected configurations
Node
zabbixzabbix_serverRange6.0.0–6.0.21
ORzabbixzabbix_serverRange6.4.0–6.4.6
ORzabbixzabbix_serverMatch7.0.0alpha1
ORzabbixzabbix_serverMatch7.0.0alpha2
ORzabbixzabbix_serverMatch7.0.0alpha3
Node
zabbixfrontendRange6.0.0–6.0.21
ORzabbixfrontendRange6.4.0–6.4.6
ORzabbixfrontendMatch7.0.0alpha1
ORzabbixfrontendMatch7.0.0alpha2
ORzabbixfrontendMatch7.0.0alpha3
| Vendor | Product | Version | CPE |
|---|---|---|---|
| zabbix | zabbix_server | * | cpe:2.3:a:zabbix:zabbix_server:*:*:*:*:*:*:*:* |
| zabbix | zabbix_server | 7.0.0 | cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha1:*:*:*:*:*:* |
| zabbix | zabbix_server | 7.0.0 | cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha2:*:*:*:*:*:* |
| zabbix | zabbix_server | 7.0.0 | cpe:2.3:a:zabbix:zabbix_server:7.0.0:alpha3:*:*:*:*:*:* |
| zabbix | frontend | * | cpe:2.3:a:zabbix:frontend:*:*:*:*:*:*:*:* |
| zabbix | frontend | 7.0.0 | cpe:2.3:a:zabbix:frontend:7.0.0:alpha1:*:*:*:*:*:* |
| zabbix | frontend | 7.0.0 | cpe:2.3:a:zabbix:frontend:7.0.0:alpha2:*:*:*:*:*:* |
| zabbix | frontend | 7.0.0 | cpe:2.3:a:zabbix:frontend:7.0.0:alpha3:*:*:*:*:*:* |
References
Related
prion
prion
Session fixation
2023-12-18 10:15:00
ubuntucve
ubuntucve
CVE-2023-32725
2023-12-18 00:00:00
cve
cve
CVE-2023-32725
2023-12-18 10:15:06
cvelist
cvelist
debiancve
debiancve
CVE-2023-32725
2023-12-18 10:15:06
redos
redos
ROS-20240328-05
2024-03-28 00:00:00
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
39.1%
Related for NVD:CVE-2023-32725