CVE catalog

CVE-2023-29449

zabbix: CVE-2023-29449

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.16% · Oct 25, 2026

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzabbixsid1:7.0.29+dfsg-2fixed
Debianzabbixforky1:7.0.29+dfsg-2fixed
Debianzabbixtrixie1:7.0.22+dfsg-1~deb13u1fixed
Debianzabbixbookworm1:6.0.14+dfsg-1vulnerable
Ubuntuzabbixpro1:5.0.8+dfsg-1build1vulnerable
Ubuntuzabbixpro1:5.0.14+dfsg-1vulnerable
Ubuntuzabbixpro1:5.0.17+dfsg-1vulnerable
Ubuntuzabbixpro1:5.0.17+dfsg-1ubuntu0.1~esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzabbixsourcesid1:6.0.23+dfsg-1not yet assignedNot reported[1055175]
Debianzabbixsourceforky1:6.0.23+dfsg-1not yet assignedNot reported[1055175]
Debianzabbixsourcetrixie1:6.0.23+dfsg-1not yet assignedNot reported[1055175]
Debianzabbixsourcebookworm(unfixed)not yet assignedNot reported[1055175]

[Debian bug #1055175]

Notes

[bookworm] zabbix: The WEB UI is only supported for access by trusted users, no security updates issued for it, #1124558

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]