Log in Start free

Vulnerability · Published Jul 13, 2023 · Assigned by Zabbix

CVE-2023-29449Limited control of resource utilization in JS preprocessing

Medium 5.9

In plain English

A medium-severity uncontrolled resource consumption in Zabbix from Zabbix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.2%top 32.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zabbixno fix listedDEBIAN-CVE-2023-29449
Debian:13zabbix1:6.0.23+dfsg-1DEBIAN-CVE-2023-29449
Debian:14zabbix1:6.0.23+dfsg-1DEBIAN-CVE-2023-29449

Affected products (as reported)

VendorProductVersions
Zabbix Zabbix 4.4.4 – through 4.4.*5.0.0alpha1 – through 5.0.315.2.0alpha1 – through 5.2.*5.4.0alpha1 – through 5.4.*6.0.0alpha1 – through 6.0.136.2.0alpha1 – through 6.2.76.4.0alpha1 – through 6.4.0beta6

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References