High severity · published Feb 3, 2025
CVE-2024-47770
Wazuh is a free and open source platform used for threat prevention, detection, and response
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. This vulnerability occurs when the system has weak privilege access, that allows an attacker to do privilege escalation. In this case the attacker is able to view agent list on Wazuh dashboard with no privilege access. This issue has been addressed in release version 4.9.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wazuh · Wazuh
before 4.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47770
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47770
Vendor Advisory
https://github.com/wazuh/wazuh/security/advisories/GHSA-648q-8m78-5cwv
More from Wazuh
9.9
CVE-2025-24016
Remote code execution in Wazuh server
9.9
CVE-2026-30893
Wazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer
9.8
CVE-2024-32038
Wazuh is a free and open source platform used for threat prevention, detection, and response
9.8
CVE-2021-44079
In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially resulting in remote code execution
9.3
CVE-2026-67308
Wazuh GitHub Actions Shell Injection via Fork Pull Request