Evil-DB LogoEvil-DB
← All CVEs

CVE-2020-15803

medium · 6.1

Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.

6.1
CVSS
32.3%
EPSS (exploit prob.)
98th
EPSS percentile
2020-07-17
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

VendorProductAffected versions
zabbixzabbix<= 3.0.31
zabbixzabbix>= 4.0.0, <= 4.0.21
zabbixzabbix>= 4.4, <= 4.4.9
zabbixzabbix>= 5.0.0, <= 5.0.1
zabbixzabbix3.0.32
zabbixzabbix4.0.22
zabbixzabbix4.0.22
zabbixzabbix4.4.10
zabbixzabbix4.4.10
zabbixzabbix5.0.2
zabbixzabbix5.0.2
fedoraprojectfedora31
fedoraprojectfedora32
debiandebian_linux9.0
opensusebackportssle-15
opensusebackportssle-15
opensuseleap15.1
opensuseleap15.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-15803