CVE-2023-29454: 
Zabbix Server vulnerability analysis and mitigation

CVE-2023-29454 is a stored cross-site scripting (XSS) vulnerability discovered in Zabbix frontend. The vulnerability affects multiple versions of Zabbix including versions 4.0.0 through 4.0.45, 5.0.0 through 5.0.33, and 6.0.0 through 6.0.16 (NVD).

The vulnerability is a stored/persistent XSS that exists in the 'Users' section under the 'Media' tab in the 'Send to' form field. When new media is created with malicious code included in the 'Send to' field, the payload gets executed when editing the same media. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (Zabbix Bug).

When successfully exploited, this vulnerability allows an attacker to store malicious code that executes when the affected media entry is edited. This could lead to unauthorized access to sensitive data, session hijacking, or other typical impacts associated with XSS attacks (Debian Security).

The vulnerability requires an authenticated user with permissions to create or edit media entries in the Zabbix frontend. The attack is persistent, meaning the malicious payload remains stored in the application and executes whenever the affected media entry is accessed (Zabbix Bug).

The vulnerability has been patched in Zabbix versions 4.0.46rc1, 5.0.35rc1, and 6.0.18rc1. Users are advised to upgrade to these or later versions to mitigate the vulnerability. No temporary workarounds have been identified (Zabbix Bug).