Description
The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Zabbix Zabbix
Default version status: unaffected
6.0.0 to ≤ 6.0.36affected6.4.0 to ≤ 6.4.20affected7.0.0 to ≤ 7.0.6affected