Skip to content
OpenAdvisories
Medium · 5.9 CVE-2023-29449 EUVD-2023-33018GHSA-7q7m-r84j-6pm2

Limited control of resource utilization in JS preprocessing

Published Jul 13, 2023 · Updated Nov 3, 2025 · Assigned by Zabbix

Description

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Affected products

VendorProductAffectedFixed
Zabbix Zabbix — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 zabbix 1:6.0.23+dfsg-1 —
Debian 13 zabbix 1:6.0.23+dfsg-1 —
Debian 12 zabbix No fix yet —
Debian 11 zabbix 1:5.0.44+dfsg-1+deb11u1 DLA-3909-1
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS zabbix No fix yet —

Advisories 2

References