Resource exhaustion in Zabbix
CVE-2023-29449
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.012 (63.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Zabbix — versions 6.4.0, 6.2.0alpha1, 6.0.0alpha1
Weakness classification (CWE)
References
- security@zabbix.com (Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-29449?
- CVE-2023-29449 is a medium-severity vulnerability in Zabbix, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2023-07-13.
- How severe is CVE-2023-29449?
- Medium severity. CVSS v3 base score is 5.9 out of 10.