Zabbix Stored Cross-Site Scripting Vulnerability in Host Navigator Widget Maintenance Tooltip

A stored cross-site scripting vulnerability has been identified in Zabbix versions 7.0.0 through 7.0.23 and 7.4.0 through 7.4.7. This vulnerability allows an authenticated (non-super) administrator to create a maintenance period containing a JavaScript payload. When any user opens the tooltip for that maintenance period in the Host navigator widget, the payload is executed. This could enable the attacker to perform unauthorized actions, depending on the user who opens the tooltip.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the maintenance tooltip.

Remediation

Users can update to Zabbix version 7.0.24 or 7.4.8, depending on their current version. Alternatively, the Host navigator widget can be disabled via the Administration -> General -> Modules menu.