CVE-2023-32725

The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.

Scoring

Severity

CRITICAL

CVSS base score

9.6

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS probability

0.27%

CWE

CWE-565

Published

2023-12-18

Last modified

2026-03-13

Affected products

• Zabbix Zabbix
• Zabbix Zabbix
• Zabbix Zabbix

Weakness type

• CWE-565

Related vulnerabilities

• CVE-2026-0257 — PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
• CVE-2023-45128 — CSRF Token Reuse Vulnerability in fiber
• CVE-2023-41084 — Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking
• CVE-2025-2395 — e-Excellence U-Office Force - Improper Authentication
• CVE-2022-50926 — WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
• CVE-2014-125112 — Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution
• CVE-2024-9970 — NewType FlowMaster BPM Plus - Privilege Escalation
• CVE-2024-22186 — Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

Markdown version · Browse all CVEs