cbcvebase.
CVE-2023-29449
published 2023-07-13

CVE-2023-29449: JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script…

PriorityP424medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
1.16%
63.7th percentile
JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Affected

15 ranges
VendorProductVersion rangeFixed in
debianzabbix< zabbix 1:5.0.44+dfsg-1+deb11u1 (bullseye)zabbix 1:5.0.44+dfsg-1+deb11u1 (bullseye)
zabbixzabbix<= 5.0.31—
zabbixzabbix——
zabbixzabbix>= 0 < 1:5.0.44+dfsg-1+deb11u11:5.0.44+dfsg-1+deb11u1
zabbixzabbix>= 0 < 1:6.0.23+dfsg-11:6.0.23+dfsg-1
zabbixzabbix>= 0 < 1:6.0.23+dfsg-11:6.0.23+dfsg-1
zabbixzabbix4.4.4 – 4.4.*—
zabbixzabbix5.0.0alpha1 – 5.0.31—
zabbixzabbix5.2.0alpha1 – 5.2.*—
zabbixzabbix5.4.0alpha1 – 5.4.*—
zabbixzabbix6.0.0 – 6.0.13—
zabbixzabbix6.0.0alpha1 – 6.0.13—
zabbixzabbix6.2.0alpha1 – 6.2.7—
zabbixzabbix6.4.0alpha1 – 6.4.0beta6—
zabbixzabbix6.4.1 – 6.4.4—

CVSS provenance

nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
osv4.9MEDIUM
vendor_debian5.9MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.