Cyber Resilience

CVE-2023-29450

Info Disclosure in Zabbix ≤ 5.0.33

Published
13 July 2023
Modified
03 November 2025
Patch / advisory
CVSS Score v3.1 8.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.013 67th percentile
Risk Priority 62 floored blend · peak EPSS

Summary

CVE-2023-29450 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Zabbix Zabbix. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 33% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1039 Data from Network Shared Drive Collection
Adversaries may search network shares on computers they have compromised to find files of interest.
T1119 Automated Collection Collection
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
T1134.001 Token Impersonation/Theft Stealth
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.
T1530 Data from Cloud Storage Collection
Adversaries may access data from cloud storage.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-32723Same product: Zabbix Zabbix
CVE-2023-32724Same product: Zabbix Zabbix
CVE-2024-22121Same product: Zabbix Zabbix
CVE-2024-22114Same product: Zabbix Zabbix
CVE-2024-42325Same product: Zabbix Zabbix
CVE-2025-27231Same product: Zabbix Zabbix
CVE-2024-36460Same product: Zabbix Zabbix
CVE-2024-36463Same product: Zabbix Zabbix
CVE-2024-42333Same product: Zabbix Zabbix
CVE-2024-36467Same product: Zabbix Zabbix

Affected Assets

zabbix
zabbix
≤ 5.0.33 · 6.0.0 — 6.0.15 · 6.4.0 — 6.4.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 12 hardening rules · 8 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.4.9
  • V11.7.1
  • V14.1.2
  • V14.2.4

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-552

Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.

addresses: CWE-200 CWE-552

Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.

addresses: CWE-200 CWE-552

Protecting confidentiality of backup information prevents unauthorized exposure of sensitive data stored in backups.

addresses: CWE-200 CWE-552

Sanitizing equipment to remove specified information before off-site maintenance prevents exposure of sensitive information to unauthorized actors such as external maintenance personnel.

addresses: CWE-200 CWE-552

The media protection policy defines requirements and procedures to prevent unauthorized disclosure or access to sensitive information on media.

addresses: CWE-200 CWE-552

Assessing control effectiveness and providing incident communication channels at alternate sites reduces the likelihood of sensitive information exposure to unauthorized actors.

addresses: CWE-200 CWE-552

Requiring protection of the program plan from unauthorized disclosure directly reduces exposure of sensitive security program details and control descriptions.

addresses: CWE-200 CWE-552

Policies mandate protection of CUI on external systems, directly reducing unauthorized exposure of sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces least-privilege authorization that blocks most unauthorized disclosures, yet CWE-200 also arises from logging, error messages, and side-channel paths that access controls alone do not address.

PR.DS-10 mostly match
prevents

PR.DS-10 mostly prevents CWE-200 by directly eliminating unauthorized access to sensitive data-in-use, yet only partially addresses the weakness because CWE-200 spans many other exposure vectors outside runtime protection.

PR.IR-01 mostly match
prevents

PR.IR-01's segmentation/zero-trust controls largely eliminate network-level unauthorized access paths that enable exposure, yet CWE-200 spans many additional vectors (API responses, logs, app logic) that network controls alone cannot close.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch most exposure flaws via design, testing and release controls, yet CWE-200 spans runtime/config issues a single development outcome cannot fully close.

PR.AA-01 partial match
prevents

PR.AA-01 supplies proper credential lifecycle controls that reduce unauthorized access paths, yet leaves many other exposure vectors (error messages, logging, side channels, etc.) unaddressed.

PR.AA-03 partial match
prevents

Authentication verifies actor identity and is a prerequisite for access decisions, yet addresses only one facet of the broad set of exposure vectors in CWE-200.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.

prevents

Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.

prevents

By requiring owners to assign sensitivity labels and corresponding handling rules, the control ensures that information is not left unmarked and therefore reduces the chance that sensitive data will be exposed to unauthorized actors.

prevents

Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.

prevents

Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.

prevents

Requiring defined procedures, assigned roles, and technical/organizational measures for handling PII reduces the chance that sensitive personal data will be exposed to unauthorized actors through inadequate handling or missing safeguards.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248579 OL 8 must restrict access to the kernel message buffer. prevents CWE-552
  • V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. prevents CWE-552
Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Ubuntu 24.04 (2 rules)
  • V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. prevents CWE-200
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Windows 10 (1 rule)
  • V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. prevents CWE-200
Windows Server 2016 (1 rule)
  • V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2019 (1 rule)
  • V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2022 (1 rule)
  • V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200

References