Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.

CVE-2023-32725

What is CVE-2023-32725?

A vulnerability in the Zabbix Web Interface allows session cookies to be improperly handled when testing or executing scheduled reports. When a website is configured in the URL widget, the application sends a session cookie to that URL, enabling unauthorized access to the frontend as the authentic user. This situation poses significant security risks, as it can lead to session hijacking and unauthorized actions within the system.

References