CVE-2023-32721

Stored XSS in Maps element

7.6 HighFix available

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: None

Exploit likelihood

0.80%Up 0.8 points since Oct 12, 2023

What each source reports

CVE List Score used 7.6

Stored XSS in Maps element

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: CVE-2023-32721
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2023-36948 7.6

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: EUVD-2023-36948
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9gfh-wppm-mm59 7.6

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is...

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: GHSA-9gfh-wppm-mm59
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-20, CWE-79
Updated: 2026-11-02

NVD 7.6

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: CVE-2023-32721
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-20, CWE-79
Updated: 2026-11-02

OSV 5.4

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: CVE-2023-32721
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-32721 5.4

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: DEBIAN-CVE-2023-32721
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-32721 7.6

A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

Record: UBUNTU-CVE-2023-32721
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

zabbix

Affected packages

Affected packages
Package	Affected	Fixed
`zabbix` Debian:12	All versions, plus listed versions 1:6.0.14+dfsg-11:6.0.23+dfsg-11:6.0.23+dfsg-1~bpo12+11:6.0.24+dfsg-11:6.0.25+dfsg-1 Show 24 moreShow less 1:6.0.29+dfsg-11:7.0.0+dfsg-11:7.0.0+dfsg-21:7.0.0+dfsg-2~bpo12+11:7.0.1+dfsg-11:7.0.1+dfsg-1~bpo12+11:7.0.10+dfsg-11:7.0.10+dfsg-21:7.0.2+dfsg-11:7.0.2+dfsg-1~bpo12+11:7.0.22+dfsg-11:7.0.22+dfsg-1.11:7.0.22+dfsg-1~bpo13+11:7.0.22+dfsg-1~deb13u11:7.0.27+dfsg-11:7.0.29+dfsg-11:7.0.29+dfsg-21:7.0.29+dfsg-2~bpo13+11:7.0.3+dfsg-11:7.0.5+dfsg-11:7.0.5+dfsg-1~bpo12+11:7.0.6+dfsg-11:7.0.9+dfsg-11:7.0.9+dfsg-1~bpo12+1	None known
`zabbix` Debian:13	before 1:6.0.23+dfsg-1	1:6.0.23+dfsg-1
`zabbix` Debian:14	before 1:6.0.23+dfsg-1	1:6.0.23+dfsg-1
`zabbix` Debian:10 From an advisory covering 3 CVEs	before 1:4.0.4+dfsg-1+deb10u4, plus listed versions 1:4.0.4+dfsg-11:4.0.4+dfsg-1+deb10u11:4.0.4+dfsg-1+deb10u21:4.0.4+dfsg-1+deb10u3	1:4.0.4+dfsg-1+deb10u4
`zabbix` Debian:11 From an advisory covering 31 CVEs	before 1:5.0.44+dfsg-1+deb11u1, plus listed versions 1:5.0.14+dfsg-11:5.0.14+dfsg-1~bpo11+11:5.0.17+dfsg-11:5.0.17+dfsg-1~bpo11+11:5.0.8+dfsg-1	1:5.0.44+dfsg-1+deb11u1
`zabbix` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1:4.0.4+dfsg-1build21:4.0.4+dfsg-1build31:4.0.11+dfsg-11:4.0.14+dfsg-11:4.0.15+dfsg-1 Show 5 moreShow less 1:4.0.16+dfsg-11:4.0.16+dfsg-1build11:4.0.17+dfsg-11:4.0.17+dfsg-1ubuntu0.1~esm11:4.0.17+dfsg-1ubuntu0.1~esm2	None known
`zabbix` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1:5.0.8+dfsg-1build11:5.0.14+dfsg-11:5.0.17+dfsg-11:5.0.17+dfsg-1ubuntu0.1~esm1	None known
`zabbix` Ubuntu:25.10	All versions, plus listed versions 1:7.0.10+dfsg-21:7.0.10+dfsg-2build1	None known
`zabbix` Ubuntu:26.10	All versions, plus listed versions 1:7.0.22+dfsg-11:7.0.22+dfsg-1.11:7.0.22+dfsg-1.1build11:7.0.22+dfsg-1.1build21:7.0.27+dfsg-1	None known
`zabbix` Ubuntu:26.04:LTS	All versions, plus listed versions 1:7.0.10+dfsg-2build11:7.0.22+dfsg-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32721 is a high vulnerability (CVSS 7.6) in Zabbix, published October 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in zabbix 1:6.0.23+dfsg-1.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References