Lucene search

[email protected]CVE-2023-29451

HistoryJul 13, 2023 - 10:15 a.m.

CVE-2023-29451

2023-07-1310:15:09

CWE-787

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-29451

buffer overrun

json parser

zabbix server

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.0%

JSON

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.

Affected configurations

NVD

Node

zabbixzabbixRange≤6.0.14

zabbixzabbixRange6.4.2–6.4.4

zabbixzabbixMatch6.4.0alpha1

zabbixzabbixMatch6.4.0beta1

zabbixzabbixMatch6.4.0beta2

zabbixzabbixMatch6.4.0beta3

zabbixzabbixMatch6.4.0beta4

zabbixzabbixMatch6.4.0beta5

zabbixzabbixMatch6.4.0beta6

zabbixzabbixMatch6.4.0rc2

zabbixzabbixMatch6.4.0rc3

zabbixzabbixMatch6.4.0rc4

CPENameOperatorVersion
zabbix:zabbixzabbixle6.0.14
zabbix:zabbixzabbixle6.4.4
zabbix:zabbixzabbixeq6.4.0

CPE	Name	Operator	Version
zabbix:zabbix	zabbix	le	6.0.14
zabbix:zabbix	zabbix	le	6.4.4
zabbix:zabbix	zabbix	eq	6.4.0

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Server",
      "Proxy"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "changes": [
          {
            "at": "6.0.15rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.14",
        "status": "affected",
        "version": "6.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.2.9rc2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.2.8",
        "status": "affected",
        "version": "6.2",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.4.1rc2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.4.0",
        "status": "affected",
        "version": "6.4",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "7.0.0alpha1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "7.0.0alpha1 ",
        "status": "affected",
        "version": "7.0.0alpha1",
        "versionType": "git"
      }
    ]
  }
]