GitHub Advisoryadvisory · npm

GHSA-w36g-q975-37rg Improper Input Validation (RCE)

HIGH Published 2021-03-18 Modified 2021-03-12 Official page ↗
Aliases
CVE-2021-26814
Ecosystem
npm
Packages
wazuh
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2021-03-12

Affected packages

• npm wazuh: >= 4.0.0, < 4.0.4 → fixed in 4.0.4

Description

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service script.

Related

Alias · CVE (1)

  • CVE-2021-26814 Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References