Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.
References
Link | Resource |
---|---|
https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427 | Issue Tracking |
https://github.com/wazuh/wazuh-kibana-app/pull/5428 | Patch |
https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf | Patch Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-10-09T16:30:28.457Z
Updated: 2023-10-09T16:30:28.457Z
Reserved: 2023-09-08T20:57:45.574Z
Link: CVE-2023-42455
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-10-09T17:15:09.923
Modified: 2023-10-13T16:26:53.420
Link: CVE-2023-42455
JSON object: View
Redhat Information
No data.
CWE