CVE-2023-29449: zabbix Uncontrolled Resource Consumption

Vulnerability summary

CVE-2023-29449 is a medium (CVSS 5.9) Uncontrolled Resource Consumption vulnerability in zabbix. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 66.5% of scored vulnerabilities.

Timeline

1. 13-07-2023
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.