CVE-2010-2790

Name	CVE-2010-2790
Description	Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php). NOTE: some of these details are obtained from third party information.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	594304

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zabbix (PTS)	jessie, jessie (lts)	1:2.2.23+dfsg-0+deb8u9	fixed
	stretch (security)	1:3.0.32+dfsg-0+deb9u3	fixed
	stretch (lts), stretch	1:3.0.32+dfsg-0+deb9u8	fixed
	buster (security), buster, buster (lts)	1:4.0.4+dfsg-1+deb10u5	fixed
	bullseye	1:5.0.8+dfsg-1	fixed
	bullseye (security)	1:5.0.45+dfsg-1+deb11u1	fixed
	bookworm	1:6.0.14+dfsg-1	fixed
	sid, trixie	1:7.0.6+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
zabbix	source	squeeze	1:1.8.2-1squeeze1
zabbix	source	(unstable)	1:1.8.3-1			594304

[lenny] - zabbix <no-dsa> (Minor issue)