CVE-2023-29452: Zabbix geomap attribution text allows stored HTML injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityRequires authenticated low-privileged access plus victim interaction, but stored XSS with scope change and a very high EPSS percentile raises the practical risk.

What it is

Zabbix geomap configuration accepts HTML in the 'Attribution text' field when the 'Other' tile provider is selected, with no sanitization. Because the value is rendered in the frontend, this is a stored cross-site scripting issue affecting users who view maps. The record does not state which Zabbix versions are affected.

Impact

An authenticated user with permission to edit geomap settings can inject script that executes in the browser of other users viewing the map, potentially stealing session data or acting as those users. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the Zabbix web interface; the attacker needs low-privileged authenticated access to the Administration -> General -> Geographical maps settings, and a victim must view the affected map (UI:R).

Exploitation

Not listed in CISA KEV and no public exploit is referenced; EPSS is high at 0.64063 (99.2nd percentile), suggesting elevated likelihood of attempted exploitation, but the record provides no confirmed in-the-wild activity.

What to do

• Apply the vendor fix referenced in Zabbix issue ZBX-22981; check the advisory for the exact patched versions since the record does not list them.
• Restrict geomap configuration permissions to trusted administrators only.
• Avoid the 'Other' tile provider with untrusted attribution text until patched, or sanitize/escape HTML in that field.
• Review existing geomap attribution values for injected HTML or script.

Detection

• Audit geomap configuration entries for HTML tags or script content in the attribution text field.
• Monitor web logs for requests to the geomap administration endpoint from unexpected accounts.
• Watch for anomalous JavaScript execution or outbound requests originating from Zabbix map pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.