Alerts This Week
Warning Icon 1 1,153
Alerts This Week
Warning Icon 1 1,153

Debian 10 Buster DLA-3717-1 Critical: Zabbix XSS, SSRF Risks

debian lts
Calendar Grey January 24, 2024
Dist Debian Esm H88
Debian LTS Advisory DLA-3717-1 highlights critical risks in Zabbix network monitoring tool; urgent updates recommended.
Several security vulnerabilities have been discovered in zabbix, a network monitoring solution, potentially allowing an attacker to perform a stored XSS, Server-Side Request Forger...
Topics%20covered

Topics Covered

security advisory security issue XSS network monitoring Debian SSRF

Summary

CVE-2023-32721

A stored XSS has been found in the Zabbix web application in the
Maps element if a URL field is set with spaces before URL.

CVE-2023-32723

Inefficient user permission check, as request to LDAP is sent before
user permissions are checked.

CVE-2023-32726

Possible buffer overread from reading DNS responses.

For Debian 10 buster, these problems have been fixed in version
1:4.0.4+dfsg-1+deb10u4.

We recommend that you upgrade your zabbix packages.

For the detailed security status of zabbix please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/zabbix

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: zabbix
Version: 1:4.0.4+dfsg-1+deb10u4
CVE ID: CVE-2023-32721 CVE-2023-32723 CVE-2023-32726
Debian Bug: 1053877

Topics%20covered

Topics Covered

security advisory security issue XSS network monitoring Debian SSRF

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here