CVE-2023-29456 Inefficient URL schema validation

2023-07-1309:33:32

CWE-20

Zabbix

www.cve.org

url validation

input parsing

internet standards.

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Frontend"
    ],
    "product": "Zabbix",
    "repo": "https://git.zabbix.com/",
    "vendor": "Zabbix",
    "versions": [
      {
        "changes": [
          {
            "at": "4.0.47rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "4.0.46",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "5.0.36rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "5.0.35",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.0.19rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.0.18",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "6.4.4rc1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.4.3",
        "status": "affected",
        "version": "6.4.0",
        "versionType": "git"
      },
      {
        "changes": [
          {
            "at": "7.0.0alpha2",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "7.0.0alpha1 ",
        "status": "affected",
        "version": "7.0.0alpha1",
        "versionType": "git"
      }
    ]
  }
]