{"id":"CVE-2020-15803","aliases":["DEBIAN-CVE-2020-15803","DLA-2311-1","DLA-2631-1","DLA-3390-1","EUVD-2020-7786","GHSA-79cm-2gxq-7x9r","SUSE-SU-2020:2251-1","UBUNTU-CVE-2020-15803","USN-4767-1","openSUSE-SU-2020:1604-1","openSUSE-SU-2022:0036-1","openSUSE-SU-2024:11539-1"],"status":"published","title":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x...","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.32304,"percentile":0.98337,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-07-17T00:00:00Z","modified":"2026-10-26T12:02:26Z","fixes":[{"ecosystem":"Debian:12","package":"zabbix","fixed_in":["1:5.0.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zabbix","fixed_in":["1:5.0.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zabbix","fixed_in":["1:5.0.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"zabbix","fixed_in":["1:3.0.7+dfsg-3+deb9u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"zabbix","fixed_in":["4.0.12-4.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"zabbix","fixed_in":["4.0.12-4.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zabbix","fixed_in":["1:2.4.7+dfsg-2ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zabbix","fixed_in":["1:3.0.12+dfsg-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","fixed_in":["1:4.0.17+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7+dfsg-3+deb9u1"}]}],"versions":["1:3.0.7+dfsg-3"]},{"source":"osv","ecosystem":"Debian:9","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.32+dfsg-0+deb9u1"}]}],"versions":["1:3.0.12+dfsg-1","1:3.0.17+dfsg-1","1:3.0.17+dfsg-1~bpo9+1","1:3.0.31+dfsg-0+deb9u1","1:3.0.7+dfsg-3","1:3.0.7+dfsg-3+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.4+dfsg-1+deb10u1"}]}],"versions":["1:4.0.4+dfsg-1"],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-4.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.7+dfsg-2ubuntu2.1+esm2"}]}],"versions":["1:2.4.6+dfsg-1","1:2.4.7+dfsg-1","1:2.4.7+dfsg-2","1:2.4.7+dfsg-2ubuntu2","1:2.4.7+dfsg-2ubuntu2.1","1:2.4.7+dfsg-2ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.12+dfsg-1ubuntu0.1~esm2"}]}],"versions":["1:3.0.7+dfsg-3","1:3.0.12+dfsg-1","1:3.0.12+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.17+dfsg-1ubuntu0.1~esm1"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.2+dfsg-1ubuntu1+esm4"}]}],"versions":["1:2.0.6+dfsg-1ubuntu2","1:2.2.0+dfsg-1ubuntu1","1:2.2.0+dfsg-6ubuntu1","1:2.2.1+dfsg-1ubuntu3","1:2.2.2+dfsg-1ubuntu1","1:2.2.2+dfsg-1ubuntu1+esm1","1:2.2.2+dfsg-1ubuntu1+esm3"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.7+dfsg-2ubuntu2.1+esm3"}]}],"versions":["1:2.4.6+dfsg-1","1:2.4.7+dfsg-1","1:2.4.7+dfsg-2","1:2.4.7+dfsg-2ubuntu2","1:2.4.7+dfsg-2ubuntu2.1","1:2.4.7+dfsg-2ubuntu2.1+esm1","1:2.4.7+dfsg-2ubuntu2.1+esm2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.12+dfsg-1ubuntu0.1~esm3"}]}],"versions":["1:3.0.7+dfsg-3","1:3.0.12+dfsg-1","1:3.0.12+dfsg-1ubuntu0.1~esm1","1:3.0.12+dfsg-1ubuntu0.1~esm2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.17+dfsg-1ubuntu0.1~esm1"}]}],"versions":["1:4.0.4+dfsg-1build2","1:4.0.4+dfsg-1build3","1:4.0.11+dfsg-1","1:4.0.14+dfsg-1","1:4.0.15+dfsg-1","1:4.0.16+dfsg-1","1:4.0.16+dfsg-1build1","1:4.0.17+dfsg-1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.31-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.31-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.31-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.31-bp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"zabbix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.37-lp153.2.3.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports"},{"vendor":"opensuse","product":"leap"},{"vendor":"zabbix","product":"zabbix"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-18057","tags":["x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRIMOXH6GSBAANDCB3ANLJK4CRLWRXT/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZHHIUYIVA5GZYLKW6A5G6HRELPOBZFE/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00007.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00007.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15803"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ZHHIUYIVA5GZYLKW6A5G6HRELPOBZFE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TIRIMOXH6GSBAANDCB3ANLJK4CRLWRXT/"},{"url":"https://github.com/advisories/GHSA-79cm-2gxq-7x9r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15803","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202251-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174253","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15803","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15803","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4767-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11800","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4C6KYLGA3MCY6Q5OM7ZL6563XFHY2RTB/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11800","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EDFZEEJCPRPPDEWV6JULRJZVSQCMYOEY/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144018","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1183014","tags":["report"]},{"url":"https://bugzilla.suse.com/1194681","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23134","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-15803","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2020-07-17T00:00:00Z","modified":"2024-08-04T13:30:22.339Z","updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7786","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2020-07-17T00:00:00Z","modified":"2024-08-04T13:30:22Z","updated_at":"2026-11-03T03:07:30.36726Z"}],"ghsa":[{"id":"GHSA-79cm-2gxq-7x9r","title":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x...","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2022-05-24T17:23:51Z","modified":"2023-04-12T18:30:40Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:29.326702Z"}],"nvd":[{"id":"CVE-2020-15803","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2020-07-17T03:15:11.437Z","modified":"2026-06-17T02:57:13.427Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:10.086163Z"}],"osv":[{"id":"CVE-2020-15803","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2020-07-17T03:15:11.437Z","modified":"2026-03-14T10:18:35.936704Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15803","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2020-07-17T03:15:11.437Z","modified":"2026-10-26T12:02:26.985136272Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-15803","description":"Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.","status":"published","published":"2020-07-17T03:15:00Z","modified":"2026-02-04T02:24:36.91725Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2311-1","title":"zabbix - security update","status":"published","published":"2020-08-03T00:00:00Z","modified":"2026-03-09T01:23:13.75879Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2631-1","title":"zabbix - security update","status":"published","published":"2021-04-21T00:00:00Z","modified":"2026-03-09T01:18:18.547396Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3390-1","title":"zabbix - security update","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-03-09T01:18:24.778318Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2020:1604-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\nUpdated to version 3.0.31.\n\n+ CVE-2020-15803: Fixed an XSS in the URL Widget (boo#1174253).\n","status":"published","published":"2020-10-04T04:22:54Z","modified":"2026-02-04T03:13:38.659539Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2022:0036-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\n- Updated to latest realease 4.0.37.\n\nSecurity issues fixed:\n\n- CVE-2022-23134: Fixed possible view of the setup pages by unauthenticated users if config file already exists (boo#1194681).\n- CVE-2021-27927: Fixed CSRF protection mechanism inside CControllerAuthenticationUpdate controller (boo#1183014).\n- CVE-2020-15803: Fixed stored XSS in the URL Widget (boo#1174253).\n\nBugfixes:\n\n- boo#1181400: Added hardening to systemd service(s)\n- boo#1144018: Restructured for easier maintenance because FATE#324346\n","status":"published","published":"2022-02-16T09:04:51Z","modified":"2026-02-04T03:06:53.907755Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11539-1","title":"zabbix-agent-4.0.32-1.4 on GA media","description":"These are all security issues fixed in the zabbix-agent-4.0.32-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:56.860815Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:2251-1","title":"Security update for zabbix","description":"This update for zabbix fixes the following issues:\n\n- Add patches to fix bsc#1174253 (CVE-2020-15803)\n","status":"published","published":"2020-08-17T10:18:19Z","modified":"2026-02-04T04:34:33.489975Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4767-1","title":"zabbix vulnerabilities","description":"Fu Chuang discovered that Zabbix did not properly parse IPs. A remote\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2020-11800)\n\nIt was discovered that Zabbix incorrectly handled certain requests. A\nremote attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2017-2824, CVE-2017-2825)\n\nIt was discovered that Zabbix incorrectly handled certain XML files. A\nremote attacker could possibly use this issue to read arbitrary files or\npotentially execute arbitrary code. This issue only affected\nUbuntu 14.04 ESM. (CVE-2014-3005)\n\nIt was discovered that Zabbix incorrectly handled certain inputs. A remote\nattacker could possibly use this issue to execute arbitrary SQL commands.\nThis issue only affected Ubuntu 14.04 ESM. (CVE-2016-10134, CVE-2016-4338)\n\nIt was discovered that Zabbix incorrectly handled the request parameter. A\nremote attacker could possibly use this issue to redirect requests to\nexternal links. This issue only affected Ubuntu 14.04 ESM and\nUbuntu 18.04 ESM. (CVE-2016-10742)\n\nIt was discovered that Zabbix incorrectly handled failed login attempts. A\nremote attacker could possibly use this issue to enumerate users.\n(CVE-2019-15132)\n\nIt was discovered that Zabbix did not properly validate input. A remote\nattacker could exploit this to conduct cross-site scripting (XSS) attacks.\nThis issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and\nUbuntu 20.04 ESM. (CVE-2020-15803)\n","status":"published","published":"2022-06-15T08:28:18Z","modified":"2026-06-29T13:48:11.851933517Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}