CVE-2023-42455CWE-639

Wazuh vulnerable to user privilege escalation

High · published October 9, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00735 · 53.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-10-09T16:30Z
EPSS history
Timeline
  • 09 OCT 16:30Z
    Wazuh vulnerable to user privilege escalation
    cvelistv5