Resource exhaustion in Zabbix

CVE-2023-29449

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Vulnerability class: DoS (Denial of Service)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.012 (65.7th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 65.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-29449: held from 0.012 to 0.012.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

  • Zabbix — versions 6.4.0, 6.2.0alpha1, 6.0.0alpha1

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2023-29449?
CVE-2023-29449 is a medium-severity vulnerability in Zabbix, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2023-07-13.
How severe is CVE-2023-29449?
Medium severity. CVSS v3 base score is 5.9 out of 10.