CVE-2023-32722 (https://support.zabbix.com/browse/ZBX-23390): The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open. CVE-2023-32723 (https://support.zabbix.com/browse/ZBX-23230): Request to LDAP is sent before user permissions are checked. CVE-2023-32724 (https://support.zabbix.com/browse/ZBX-23391): Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation. CVE-2023-32721 (https://support.zabbix.com/browse/ZBX-23389): A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL. CVE-2023-29453 (https://support.zabbix.com/browse/ZBX-23388): Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g., "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template. Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution. CVE-2023-29451 (https://support.zabbix.com/browse/ZBX-22587): Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. CVE-2023-29452 (https://support.zabbix.com/browse/ZBX-22981): Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. CVE-2023-29458 (https://support.zabbix.com/browse/ZBX-22989): Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use. CVE-2023-29449 (https://support.zabbix.com/browse/ZBX-22589): JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access. CVE-2023-29450 (https://support.zabbix.com/browse/ZBX-22588): JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data. Seems like Zabbix has just released a bunch of HackerOne CVEs, with a weird mix of fix versions. Nevertheless, we seem to be all fixed for them.
