CVE-2023-49275CWE-476

Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd

Medium · published April 19, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Wazuh is a free and open source platform used for threat prevention, detection, and response. A NULL pointer dereference was detected during fuzzing of the analysis engine, allowing malicious clients to DoS the analysis engine. The bug occurs when `analysisd` receives a syscollector message with the `hotfix` `msg_type` but lacking a `timestamp`. It uses `cJSON_GetObjectItem()` to get the `timestamp` object item and dereferences it without checking for a `NULL` value. A malicious client can DoS the analysis engine. This vulnerability is fixed in 4.7.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00881 · 58.7th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-04-19T14:24Z
EPSS history
Timeline
  • 19 APR 14:24Z
    Wazuh vulnerable to NULL Pointer Dereference in wazuh-analysisd
    cvelistv5