{"id":"CVE-2023-29452","published":"2023-07-13T09:29:55Z","modified":"2024-10-22T16:23:20Z","title":"Remove possibility to add html into Geomap attribution field","vendor":"Zabbix","product":"Zabbix","tier":"core","eol":null,"affectedVersions":[{"vendor":"Zabbix","product":"Zabbix","versions":[">= 6.0.0, <= 6.0.17",">= 6.4.0, <= 6.4.2",">= 7.0.0, <= 7.0.0alpha1"]}],"description":{"text":"\nCurrently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.\n\n","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is improper input validation in Zabbix's geographical maps configuration (Administration, General, Geographical maps), where the \"Attribution text\" field accepts HTML when the \"Other\" tile provider is selected. An attacker who has low-privilege authenticated access and can get a user to interact with the page can abuse this unsanitised HTML input, which is what the attack vector's network, low-privilege and user-interaction requirements describe.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:32Z"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.64063,"percentile":0.99226,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-22981","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-33021","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33021","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-29452","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":23.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9923"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.85,"detail":"base score 5.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}