CVE-2023-32725 — Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.

CVE-2023-32725

Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget. PUBLISHED

Description (CNA)

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.21; affected 6.4.0 through 6.4.6; affected 7.0.0alpha1 through 7.0.0alpha3

CWE

CWE-565

References

https://support.zabbix.com/browse/ZBX-23854

ADP enrichment

CVE

No English description supplied.

https://support.zabbix.com/browse/ZBX-23854