CVE-2011-2904

Zabbix < 1.8.5 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.

References (11)

[Vendor Advisory] http://secunia.com/advisories/45502

[Vendor Advisory] http://secunia.com/advisories/45677

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/49016

[Patch] http://www.zabbix.com/rn1.8.6.php

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=729162

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/69025

[Exploit] https://support.zabbix.com/browse/ZBX-3835

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063884.html

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063904.html

[Mailing List] http://www.openwall.com/lists/oss-security/2011/08/08/2

[Mailing List] http://www.openwall.com/lists/oss-security/2011/08/09/5

Scores

EPSS 0.0076

EPSS Percentile 73.2%

Classification

CWE

CWE-79

Status published

Affected Products (50)

zabbix/zabbix < 1.8.5

zabbix/zabbix

... and 35 more

Timeline

Published Aug 19, 2011

Tracked Since Feb 18, 2026