CVE-2023-29451 - Vulnerability Details

Vendors	Products
Zabbix	Zabbix

Link	Providers
https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
https://support.zabbix.com/browse/ZBX-22587

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29451", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2023-04-06T18:04:44.891Z", "datePublished": "2023-07-13T09:29:42.494Z", "dateUpdated": "2025-02-13T16:49:18.150Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["Server", "Proxy"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.15rc1", "status": "unaffected"}], "lessThanOrEqual": "6.0.14", "status": "affected", "version": "6.0", "versionType": "git"}, {"changes": [{"at": "6.2.9rc2", "status": "unaffected"}], "lessThanOrEqual": "6.2.8", "status": "affected", "version": "6.2", "versionType": "git"}, {"changes": [{"at": "6.4.1rc2", "status": "unaffected"}], "lessThanOrEqual": "6.4.0", "status": "affected", "version": "6.4", "versionType": "git"}, {"changes": [{"at": "7.0.0alpha1", "status": "unaffected"}], "lessThanOrEqual": "7.0.0alpha1", "status": "affected", "version": "7.0.0alpha1", "versionType": "git"}]}], "datePublic": "2023-03-10T11:05:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy."}], "value": "Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy."}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2023-08-22T15:06:24.335Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-22587"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial of service caused by a bug in the JSON parser", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:07:46.279Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.zabbix.com/browse/ZBX-22587", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-22T16:25:43.640794Z", "id": "CVE-2023-29451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T16:26:17.639Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-29451 (string)

assignerOrgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

state : PUBLISHED (string)

assignerShortName : Zabbix (string)

dateReserved : 2023-04-06T18:04:44.891Z (string)

datePublished : 2023-07-13T09:29:42.494Z (string)

dateUpdated : 2025-02-13T16:49:18.150Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : affected (string)

modules : [ »

0 : Server (string)

1 : Proxy (string)

]

product : Zabbix (string)

repo : https://git.zabbix.com/ (string)

vendor : Zabbix (string)

versions : [ »

0 : { »

changes : [ »

0 : { »

at : 6.0.15rc1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.0.14 (string)

status : affected (string)

version : 6.0 (string)

versionType : git (string)

}

1 : { »

changes : [ »

0 : { »

at : 6.2.9rc2 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.2.8 (string)

status : affected (string)

version : 6.2 (string)

versionType : git (string)

}

2 : { »

changes : [ »

0 : { »

at : 6.4.1rc2 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 6.4.0 (string)

status : affected (string)

version : 6.4 (string)

versionType : git (string)

}

3 : { »

changes : [ »

0 : { »

at : 7.0.0alpha1 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 7.0.0alpha1 (string)

status : affected (string)

version : 7.0.0alpha1 (string)

versionType : git (string)

}

]

}

]

datePublic : 2023-03-10T11:05:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. (string)

}

]

value : Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-469 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-469 HTTP DoS (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-20 (string)

description : CWE-20 Improper Input Validation (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

shortName : Zabbix (string)

dateUpdated : 2023-08-22T15:06:24.335Z (string)

}

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-22587 (string)

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Denial of service caused by a bug in the JSON parser (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T14:07:46.279Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-22587 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-22T16:25:43.640794Z (string)

id : CVE-2023-29451 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-22T16:26:17.639Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.zabbix.com/browse/ZBX-22587", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:07:46.279Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-29451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T16:25:43.640794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T16:26:12.615Z"}}], "cna": {"title": "Denial of service caused by a bug in the JSON parser", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Server", "Proxy"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.15rc1", "status": "unaffected"}], "version": "6.0", "versionType": "git", "lessThanOrEqual": "6.0.14"}, {"status": "affected", "changes": [{"at": "6.2.9rc2", "status": "unaffected"}], "version": "6.2", "versionType": "git", "lessThanOrEqual": "6.2.8"}, {"status": "affected", "changes": [{"at": "6.4.1rc2", "status": "unaffected"}], "version": "6.4", "versionType": "git", "lessThanOrEqual": "6.4.0"}, {"status": "affected", "changes": [{"at": "7.0.0alpha1", "status": "unaffected"}], "version": "7.0.0alpha1", "versionType": "git", "lessThanOrEqual": "7.0.0alpha1 "}], "defaultStatus": "affected"}], "datePublic": "2023-03-10T11:05:00.000Z", "references": [{"url": "https://support.zabbix.com/browse/ZBX-22587"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.", "supportingMedia": [{"type": "text/html", "value": "Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2023-07-13T09:29:42.494Z"}}}, "cveMetadata": {"cveId": "CVE-2023-29451", "state": "PUBLISHED", "dateUpdated": "2024-10-22T16:26:17.639Z", "dateReserved": "2023-04-06T18:04:44.891Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2023-07-13T09:29:42.494Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-22587 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T14:07:46.279Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-29451 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-22T16:25:43.640794Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-22T16:26:12.615Z (string)

}

]

cna : { »

title : Denial of service caused by a bug in the JSON parser (string)

source : { »

discovery : UNKNOWN (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-469 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-469 HTTP DoS (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.7 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : HIGH (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

repo : https://git.zabbix.com/ (string)

vendor : Zabbix (string)

modules : [ »

0 : Server (string)

1 : Proxy (string)

]

product : Zabbix (string)

versions : [ »

0 : { »

status : affected (string)

changes : [ »

0 : { »

at : 6.0.15rc1 (string)

status : unaffected (string)

}

]

version : 6.0 (string)

versionType : git (string)

lessThanOrEqual : 6.0.14 (string)

}

1 : { »

status : affected (string)

changes : [ »

0 : { »

at : 6.2.9rc2 (string)

status : unaffected (string)

}

]

version : 6.2 (string)

versionType : git (string)

lessThanOrEqual : 6.2.8 (string)

}

2 : { »

status : affected (string)

changes : [ »

0 : { »

at : 6.4.1rc2 (string)

status : unaffected (string)

}

]

version : 6.4 (string)

versionType : git (string)

lessThanOrEqual : 6.4.0 (string)

}

3 : { »

status : affected (string)

changes : [ »

0 : { »

at : 7.0.0alpha1 (string)

status : unaffected (string)

}

]

version : 7.0.0alpha1 (string)

versionType : git (string)

lessThanOrEqual : 7.0.0alpha1 (string)

}

]

defaultStatus : affected (string)

}

]

datePublic : 2023-03-10T11:05:00.000Z (string)

references : [ »

0 : { »

url : https://support.zabbix.com/browse/ZBX-22587 (string)

}

1 : { »

url : https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-20 (string)

description : CWE-20 Improper Input Validation (string)

}

]

}

]

providerMetadata : { »

orgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

shortName : Zabbix (string)

dateUpdated : 2023-07-13T09:29:42.494Z (string)

}

cveMetadata : { »

cveId : CVE-2023-29451 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-22T16:26:17.639Z (string)

dateReserved : 2023-04-06T18:04:44.891Z (string)

assignerOrgId : 72de3e22-0555-4a0d-ae81-9249e0f0a1e8 (string)

datePublished : 2023-07-13T09:29:42.494Z (string)

assignerShortName : Zabbix (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "01F553B6-48B5-4415-BF02-FBD83B16D577", "versionEndIncluding": "6.0.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DE4CDDA-721E-4B2D-ACCE-718B98C85059", "versionEndIncluding": "6.4.4", "versionStartIncluding": "6.4.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "F8EEB422-9B08-4BB9-A1DD-1F391B93031B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "D2DBFD04-80FA-496C-8A4D-36008777FCE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "409DEB61-6951-48FE-8BA8-32AFE432C114", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "E596AE82-54AD-4689-A59C-E4E906439731", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "AD9D1FC3-9AD5-4281-82DD-46957ECD4EEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "81B14635-6FD0-4E9D-BCCD-3F88A3337B3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:beta6:*:*:*:*:*:*", "matchCriteriaId": "425BB43B-4557-4D6F-9748-D0E6146A47E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "495EB7AA-D9AD-43C0-A04E-66013AF2DBC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "1FCEBEB2-AD19-4259-9BAC-D96E55384193", "vulnerable": true}, {"criteria": "cpe:2.3:a:zabbix:zabbix:6.4.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "E8290F5B-E1F0-4081-B365-CB1A7F2A5DA3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy."}], "id": "CVE-2023-29451", "lastModified": "2024-11-21T07:57:04.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "security@zabbix.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-13T10:15:09.137", "references": [{"source": "security@zabbix.com", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html"}, {"source": "security@zabbix.com", "tags": ["Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-22587"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.zabbix.com/browse/ZBX-22587"}], "sourceIdentifier": "security@zabbix.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@zabbix.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 01F553B6-48B5-4415-BF02-FBD83B16D577 (string)

versionEndIncluding : 6.0.14 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2DE4CDDA-721E-4B2D-ACCE-718B98C85059 (string)

versionEndIncluding : 6.4.4 (string)

versionStartIncluding : 6.4.2 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:alpha1:*:*:*:*:*:* (string)

matchCriteriaId : F8EEB422-9B08-4BB9-A1DD-1F391B93031B (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : D2DBFD04-80FA-496C-8A4D-36008777FCE3 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : 409DEB61-6951-48FE-8BA8-32AFE432C114 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : E596AE82-54AD-4689-A59C-E4E906439731 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:beta4:*:*:*:*:*:* (string)

matchCriteriaId : AD9D1FC3-9AD5-4281-82DD-46957ECD4EEF (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:beta5:*:*:*:*:*:* (string)

matchCriteriaId : 81B14635-6FD0-4E9D-BCCD-3F88A3337B3A (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:beta6:*:*:*:*:*:* (string)

matchCriteriaId : 425BB43B-4557-4D6F-9748-D0E6146A47E5 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:rc2:*:*:*:*:*:* (string)

matchCriteriaId : 495EB7AA-D9AD-43C0-A04E-66013AF2DBC0 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:rc3:*:*:*:*:*:* (string)

matchCriteriaId : 1FCEBEB2-AD19-4259-9BAC-D96E55384193 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zabbix:zabbix:6.4.0:rc4:*:*:*:*:*:* (string)

matchCriteriaId : E8290F5B-E1F0-4081-B365-CB1A7F2A5DA3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy. (string)

}

]

id : CVE-2023-29451 (string)

lastModified : 2024-11-21T07:57:04.990 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 3.4 (number)

source : security@zabbix.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-07-13T10:15:09.137 (string)

references : [ »

0 : { »

source : security@zabbix.com (string)

url : https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html (string)

}

1 : { »

source : security@zabbix.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.zabbix.com/browse/ZBX-22587 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.zabbix.com/browse/ZBX-22587 (string)

}

]

sourceIdentifier : security@zabbix.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : security@zabbix.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-787 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object