High severity · published Oct 9, 2023
CVE-2023-42455
Wazuh is a security detection, visibility, and compliance open source project
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wazuh-dashboard · Wazuh
4.4.0 before 4.4.2 · source: NVD
WA
Wazuh-kibana-app · Wazuh
4.4.0 before 4.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42455
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42455
Issue Tracking
https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427
Patch
https://github.com/wazuh/wazuh-kibana-app/pull/5428
Patch
https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf