Bug 1216222 (CVE-2023-32721) - VUL-0: CVE-2023-32721: zabbix: A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.
Summary: VUL-0: CVE-2023-32721: zabbix: A stored XSS has been found in the Zabbix web ...
Status: CONFIRMED
Alias: CVE-2023-32721
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Boris Manojlovic
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/381645/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-13 13:11 UTC by SMASH SMASH
Modified: 2023-10-17 21:05 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-10-13 13:11:50 UTC 
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-32721
Comment 1 Gabriele Sonnu 2023-10-13 13:14:22 UTC 
https://support.zabbix.com/browse/ZBX-23389

Affected version/s and fix version/s:
* 4.0.0 - 4.0.47 / 4.0.48rc1
* 5.0.0 - 5.0.36 / 5.0.37rc1
* 6.0.0 - 6.0.20 / 6.0.21rc1
* 6.4.0 - 6.4.5 / 6.4.6rc1
* 7.0.0alpha1 - 7.0.0alpha3 / 7.0.0alpha4

The maintained SUSE code stream is only used to publish the zabbix-agent,
therefore SLE-12 is not affected.

SUSE:SLE-12-SP3:Update  zabbix-4.0.12

The maintained openSUSE versions is 4.0.47 and needs to be fixed.

openSUSE:Backports:SLE-15-SP5  zabbix-4.0.47
openSUSE:Backports:SLE-15-SP6  zabbix-4.0.47


The openSUSE:Backports:SLE-15-SP6 could still be updated to a higher version.
It's still possible to submit to the GA branch.
Comment 2 Alexander Bergmann 2023-10-16 13:06:59 UTC 
@Boris: Could yo prepare a submission?
Comment 3 Boris Manojlovic 2023-10-17 21:05:31 UTC 
(In reply to Alexander Bergmann from comment #2)
> @Boris: Could yo prepare a submission?

It is in pipeline now waiting to be pushed
https://build.opensuse.org/request/show/1118376