CVE-2020-15803: [ZBX-18057] Stored Cross Site Scripting attack on URL widget (CVE-2020-15803)

• **Type: ** Defect (Security)

• Status: Closed

• **Priority: ** Trivial

• Resolution: Fixed

• Affects Version/s: 4.0.21rc1, 5.0.1rc1

• Sprint:

  Sprint 66 (Jul 2020)

1. Add in to zabbix defines configuration to use iFrame sandbox parameter
   1. On by default
   2. Update documentation on https://www.zabbix.com/documentation/current/manual/installation/requirements/best_practices
2. Add sandbox parameter to URL widget iframe

As a separate change will be refactoring of definex.inc to allow user override defines without reset the values on update.

causes

ZBXNEXT-82 support of ‘local’ config files

• Closed