Lucene search

[email protected]CVE-2023-29449

HistoryJul 13, 2023 - 9:15 a.m.

CVE-2023-29449

2023-07-1309:15:09

CWE-400

CWE-770

[email protected]

web.nvd.nist.gov

cve-2023-29449

javascript preprocessing

webhooks

global scripts

cpu utilization

memory utilization

disk i/o utilization

administrative roles

security risk

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.3%

JSON

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Affected configurations

NVD

Node

zabbixzabbixRange≤5.0.31

zabbixzabbixRange6.0.0–6.0.13

zabbixzabbixRange6.4.1–6.4.4

zabbixzabbixMatch6.4.0alpha1

zabbixzabbixMatch6.4.0beta1

zabbixzabbixMatch6.4.0beta2

zabbixzabbixMatch6.4.0beta3

zabbixzabbixMatch6.4.0beta4

zabbixzabbixMatch6.4.0beta5

zabbixzabbixMatch6.4.0beta6

zabbixzabbixMatch6.4.0rc2

zabbixzabbixMatch6.4.0rc3

zabbixzabbixMatch6.4.0rc4

CPENameOperatorVersion
zabbix:zabbixzabbixle5.0.31
zabbix:zabbixzabbixle6.0.13
zabbix:zabbixzabbixle6.4.4
zabbix:zabbixzabbixeq6.4.0

CPE	Name	Operator	Version
zabbix:zabbix	zabbix	le	5.0.31
zabbix:zabbix	zabbix	le	6.0.13
zabbix:zabbix	zabbix	le	6.4.4
zabbix:zabbix	zabbix	eq	6.4.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Server",
      "Proxy"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "lessThanOrEqual": "4.4.*",
        "status": "affected",
        "version": "4.4.4",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "5.0.32rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.0.31",
        "status": "affected",
        "version": "5.0.0alpha1",
        "versionType": "git"
      },
      {
        "lessThanOrEqual": "5.2.*",
        "status": "affected",
        "version": "5.2.0alpha1",
        "versionType": "git"
      },
      {
        "lessThanOrEqual": "5.4.*",
        "status": "affected",
        "version": "5.4.0alpha1",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.0.14rc1 (6.0.16 is recommended)",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.13",
        "status": "affected",
        "version": "6.0.0alpha1",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.2.8rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.2.7",
        "status": "affected",
        "version": "6.2.0alpha1",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.4.0rc2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.4.0beta6",
        "status": "affected",
        "version": "6.4.0alpha1 ",
        "versionType": "git"
      }
    ]
  }
]