CVE-2023-29449 Vulnerability Details

  /     /     /  

CVE-2023-29449 Metadata Quick Info

CVE Published: 13/07/2023 | CVE Updated: 22/10/2024 | CVE Year: 2023
Source: Zabbix | Vendor: Zabbix | Product: Zabbix
Status : PUBLISHED

---

CVE-2023-29449 Description

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Metrics

CVSS Version: 3.1 | Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* NONE
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-400
CWE Name: CWE-400 Uncontrolled Resource Consumption
Source: Zabbix

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-130
CAPEC Description: CAPEC-130 Excessive Allocation


Source: NVD (National Vulnerability Database).