CVE-2020-15803
Fixed in a distro release EPSS 32%
Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.
Products: zabbix, fedoraproject fedora, debian_linux, opensuse backports, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | zabbix | 1:4.0.4+dfsg-1+deb10u1 |
| Debian 12 | zabbix | 1:5.0.2+dfsg-1 |
| Debian 13 | zabbix | 1:5.0.2+dfsg-1 |
| Debian 14 | zabbix | 1:5.0.2+dfsg-1 |
| Debian 9 | zabbix | 1:3.0.7+dfsg-3+deb9u1 |
| Debian 9 | zabbix | 1:3.0.32+dfsg-0+deb9u1 |
| SUSE Linux Enterprise Server 12 SP5 | zabbix | 4.0.12-4.7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | zabbix | 4.0.12-4.7.1 |
| SUSE Package Hub 15 SP1 | zabbix | 3.0.31-bp152.2.3.1 |
| SUSE Package Hub 15 SP2 | zabbix | 3.0.31-bp152.2.3.1 |
| Ubuntu Pro 14.04 LTS | zabbix | 1:2.2.2+dfsg-1ubuntu1+esm4 |
| Ubuntu Pro 16.04 LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm2 |
| Ubuntu Pro 16.04 LTS | zabbix | 1:2.4.7+dfsg-2ubuntu2.1+esm3 |
| Ubuntu Pro 18.04 LTS | zabbix | 1:3.0.12+dfsg-1ubuntu0.1~esm2 |
| Ubuntu Pro 18.04 LTS | zabbix | 1:3.0.12+dfsg-1ubuntu0.1~esm3 |
| Ubuntu Pro 20.04 LTS | zabbix | 1:4.0.17+dfsg-1ubuntu0.1~esm1 |
| openSUSE Leap 15.1 | zabbix | 3.0.31-bp152.2.3.1 |
| openSUSE Leap 15.2 | zabbix | 3.0.31-bp152.2.3.1 |
| openSUSE Leap 15.3 | zabbix | 4.0.37-lp153.2.3.1 |