Search
Find a vulnerability
Search criteria
2 vulnerabilities found for wazuh-kibana-app by wazuh
CVE-2023-42455 (GCVE-0-2023-42455)
Vulnerability from nvd – Published: 2023-10-09 16:30 – Updated: 2024-09-19 16:56
VLAI
EPSS
VEX
Title
Wazuh vulnerable to user privilege escalation
Summary
Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wazuh/wazuh-kibana-app/securit… | x_refsource_CONFIRM |
| https://github.com/wazuh/wazuh-dashboard-plugins/… | x_refsource_MISC |
| https://github.com/wazuh/wazuh-kibana-app/pull/5428 | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| wazuh | wazuh-kibana-app |
Affected:
>= 4.4.0, < 4.4.2
|
|
| wazuh | wazuh-kibana-app |
Affected:
4.4.0 , < 4.4.2
(custom)
cpe:2.3:a:wazuh:wazuh-kibana-app:*:*:*:*:*:wazuh:*:* |
|
| wazuh | wazuh-dashboard |
Affected:
4.4.0 , < 4.4.2
(custom)
cpe:2.3:a:wazuh:wazuh-dashboard:*:*:*:*:*:wazuh:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:38.920Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf"
},
{
"name": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427"
},
{
"name": "https://github.com/wazuh/wazuh-kibana-app/pull/5428",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/pull/5428"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wazuh:wazuh-kibana-app:*:*:*:*:*:wazuh:*:*"
],
"defaultStatus": "unknown",
"product": "wazuh-kibana-app",
"vendor": "wazuh",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:wazuh:wazuh-dashboard:*:*:*:*:*:wazuh:*:*"
],
"defaultStatus": "unknown",
"product": "wazuh-dashboard",
"vendor": "wazuh",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T16:54:40.875461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T16:56:26.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wazuh-kibana-app",
"vendor": "wazuh",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.4.0, \u003c 4.4.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-09T16:30:28.457Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf"
},
{
"name": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427"
},
{
"name": "https://github.com/wazuh/wazuh-kibana-app/pull/5428",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/pull/5428"
}
],
"source": {
"advisory": "GHSA-8w7x-52r7-qvjf",
"discovery": "UNKNOWN"
},
"title": "Wazuh vulnerable to user privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-42455",
"datePublished": "2023-10-09T16:30:28.457Z",
"dateReserved": "2023-09-08T20:57:45.574Z",
"dateUpdated": "2024-09-19T16:56:26.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42455 (GCVE-0-2023-42455)
Vulnerability from cvelistv5 – Published: 2023-10-09 16:30 – Updated: 2024-09-19 16:56
VLAI
EPSS
VEX
Title
Wazuh vulnerable to user privilege escalation
Summary
Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wazuh/wazuh-kibana-app/securit… | x_refsource_CONFIRM |
| https://github.com/wazuh/wazuh-dashboard-plugins/… | x_refsource_MISC |
| https://github.com/wazuh/wazuh-kibana-app/pull/5428 | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| wazuh | wazuh-kibana-app |
Affected:
>= 4.4.0, < 4.4.2
|
|
| wazuh | wazuh-kibana-app |
Affected:
4.4.0 , < 4.4.2
(custom)
cpe:2.3:a:wazuh:wazuh-kibana-app:*:*:*:*:*:wazuh:*:* |
|
| wazuh | wazuh-dashboard |
Affected:
4.4.0 , < 4.4.2
(custom)
cpe:2.3:a:wazuh:wazuh-dashboard:*:*:*:*:*:wazuh:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:38.920Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf"
},
{
"name": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427"
},
{
"name": "https://github.com/wazuh/wazuh-kibana-app/pull/5428",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/pull/5428"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wazuh:wazuh-kibana-app:*:*:*:*:*:wazuh:*:*"
],
"defaultStatus": "unknown",
"product": "wazuh-kibana-app",
"vendor": "wazuh",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:wazuh:wazuh-dashboard:*:*:*:*:*:wazuh:*:*"
],
"defaultStatus": "unknown",
"product": "wazuh-dashboard",
"vendor": "wazuh",
"versions": [
{
"lessThan": "4.4.2",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T16:54:40.875461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-19T16:56:26.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "wazuh-kibana-app",
"vendor": "wazuh",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.4.0, \u003c 4.4.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-09T16:30:28.457Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjf"
},
{
"name": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427"
},
{
"name": "https://github.com/wazuh/wazuh-kibana-app/pull/5428",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/wazuh/wazuh-kibana-app/pull/5428"
}
],
"source": {
"advisory": "GHSA-8w7x-52r7-qvjf",
"discovery": "UNKNOWN"
},
"title": "Wazuh vulnerable to user privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-42455",
"datePublished": "2023-10-09T16:30:28.457Z",
"dateReserved": "2023-09-08T20:57:45.574Z",
"dateUpdated": "2024-09-19T16:56:26.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}