CVE-2023-42455

HIGH Year: 2023
CVSS v3 Score
8.8
High
Weakness Type
CWE-639
View all →

Vulnerability Description

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.

Related Vulnerabilities

CVE-2014-8356

HIGH
CVSS:8.8(High)

The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct...

CWE-6392014

CVE-2017-3183

HIGH
CVSS:8.8(High)

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Tre...

CWE-6392017

CVE-2018-16608

HIGH
CVSS:8.8(High)

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR).

CWE-6392018

CVE-2019-12742

HIGH
CVSS:8.8(High)

Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object R...

CWE-6392019

CVE-2019-13605

HIGH
CVSS:8.8(High)

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker ...

CWE-6392019

CVE-2019-16403

HIGH
CVSS:8.8(High)

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.

CWE-6392019