CVE-2023-32725

When a user tests a URL widget or the system executes a scheduled report, the Zabbix server sends an HTTP request to the configured URL, including the logged-in user's session cookie. The owner or controller of the target website can intercept this cookie. The session cookie obtained in this way can then be used to authenticate to the Zabbix frontend interface as that user, without knowing their password.

An attacker who intercepts a session cookie can gain full access to the Zabbix interface with the compromised user's permissions, which depending on the role may result in takeover of the monitored infrastructure, modification of configuration, or disclosure of sensitive environmental data.

Apply patches available from the vendor in accordance with the references (https://support.zabbix.com/browse/ZBX-23854). Additionally, it is recommended to review the configuration of URL widgets and scheduled reports to verify that they point only to trusted, internal addresses.

Zabbix Server and Zabbix Frontend — versions indicated in the vendor's references (https://support.zabbix.com/browse/ZBX-23854)