critical9.6
CVE-2023-32725
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports.
Impact
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zabbix | Zabbix Server | from 6.0.0 through 6.0.21 from 6.4.0 through 6.4.6 Version 7.0.0 |
| Zabbix | Frontend | from 6.0.0 through 6.0.21 from 6.4.0 through 6.4.6 Version 7.0.0 |