Wazuh dashboard plugins let authenticated users override Manager API authorization header
Someone logged into the Wazuh security dashboard can act under other people's access.
Summary
Authenticated users of the Wazuh dashboard plugins can replace the Authorization header on proxied requests, acting as another Manager API identity or sending unauthenticated requests. Versions from 4.9.0 before 4.14.9 are affected.
Affected when
- An authenticated Wazuh dashboard user account
What to do
Update to 4.14.9 or later.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen