title: Limited control of resource utilization in JS preprocessing
description: JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
defaultStatus: unaffected
modules: [Server, Proxy]
product: Zabbix
repo: https://git.zabbix.com/
vendor: Zabbix
versions:
lessThanOrEqual: 4.4.*, status: affected, version: 4.4.4, versionType: git
changes: [at: 5.0.32rc1, status: unaffected], lessThanOrEqual: 5.0.31, status: affected, version: 5.0.0alpha1, versionType: git
lessThanOrEqual: 5.2.*, status: affected, version: 5.2.0alpha1, versionType: git
lessThanOrEqual: 5.4.*, status: affected, version: 5.4.0alpha1, versionType: git
changes: [at: 6.0.14rc1 (6.0.16 is recommended), status: unaffected], lessThanOrEqual: 6.0.13, status: affected, version: 6.0.0alpha1, versionType: git
changes: [at: 6.2.8rc1, status: unaffected], lessThanOrEqual: 6.2.7, status: affected, version: 6.2.0alpha1, versionType: git
changes: [at: 6.4.0rc2, status: unaffected], lessThanOrEqual: 6.4.0beta6, status: affected, version: 6.4.0alpha1 , versionType: git
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL