CVE-2023-29449

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is limited because not all users have this level of access.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29455.4Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294507.5JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the CVE-2023-294517.5Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.CVE-2023-294525.4Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when sele CVE-2023-294539.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-294545.4Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the CVE-2023-294556.1Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim'CVE-2023-294565.4URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure tha CVE-2023-294576.1Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated CVE-2023-294587.5Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in vals CVE-2023-294596.1The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.Sp CVE-2023-29468.1Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.