Executive Summary

This vulnerability exists in the Item history widget (in Zabbix 7.0 and later) and the Plain text widget (in Zabbix 6.0). When HTML display is enabled, these widgets can execute injected JavaScript code.

An attacker who controls a monitored host can inject malicious JavaScript into these widgets. When a user opens a dashboard containing the affected widget, the injected JavaScript runs with that user's permissions.

This means the attacker can perform unauthorized actions depending on the privileges of the user viewing the dashboard.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can execute unauthorized actions within the Zabbix dashboard environment by injecting malicious JavaScript.

Since the malicious code runs with the permissions of the user who opens the dashboard, the attacker could potentially perform actions that the user is authorized to do, leading to unauthorized access or manipulation of data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should disable the HTML display feature in the Item history widget (Zabbix 7.0+) or the Plain text widget (Zabbix 6.0) to prevent execution of injected JavaScript.

Additionally, ensure that monitored hosts are trusted and not controlled by attackers, as the malicious JavaScript must originate from a monitored host.

Consider updating to the latest version of Zabbix where possible, and review user permissions to limit exposure to potentially malicious dashboards.

Useful 0 Not Useful 0