LiveActive security incident?Get immediate response
CVE Record

CVE-2023-29455: Reflected XSS in several fields of graph form

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.

MediumCVSS 5.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-29455 is a medium-severity reflected cross-site scripting issue in Zabbix graph form fields. A maliciously crafted interaction could cause script execution in a user's browser, risking limited data exposure or unauthorized UI actions within that session.

Executive priority

Treat as a timely patching item, not a crisis. The issue can affect monitoring portal trust and user sessions, but the provided evidence rates impact as medium and does not show active exploitation.

Technical view

The CVE describes reflected XSS in several Zabbix graph form fields, classified as CWE-20. CVSS 3.1 is 5.4 with network attack vector, low complexity, low privileges required, unchanged scope, and low confidentiality and integrity impact.

Likely exposure

Exposure is most relevant to organizations running Zabbix versions listed as affected: 4.0.0 and 5.0.0. Debian LTS references indicate packaged Zabbix users should also review distribution advisories.

Exploitation context

The source bundle does not show CISA KEV listing or cited active exploitation. Reflected XSS typically depends on vulnerable web UI access and a crafted request reaching a user browser; this assessment does not provide exploit workflow.

Researcher notes

Key uncertainty is version specificity: the bundle lists affected starts but not exact fixed upstream releases. Validate against ZBX-22986 and Debian LTS advisories before closing exposure. Avoid assuming exploit-in-the-wild without additional evidence.

Mitigation direction

  • Review Zabbix advisory ZBX-22986 for official fixed versions and guidance.
  • Apply relevant Debian LTS Zabbix security updates where Debian packages are used.
  • Limit Zabbix web interface access to trusted users and networks.
  • Prioritize remediation for internet-accessible or broadly accessible monitoring portals.

Validation and detection

  • Inventory Zabbix deployments and confirm installed upstream or Debian package versions.
  • Check whether deployed versions match the CVE's affected Zabbix 4.0.0 or 5.0.0 entries.
  • Review access controls for the Zabbix web front end.
  • Confirm vendor or distribution security updates have been applied.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-29455 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.4Medium
CVSS 3.1 vector shape for CVE-2023-29455Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ZabbixZabbix4.0.0, 5.0.0affected
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

Improper Input Validation

Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs