GHSA-w36g-q975-37rg

Improper Input Validation (RCE)

Source: GitHub Advisory Database (reviewed) High CVE-2021-26814

Packages

Ecosystem	Package	Affected	Fixed in
npm	wazuh	>= 4.0.0, < 4.0.4	4.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service script.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-26814 advisory
https://documentation.wazuh.com/4.0/release-notes/release_4_0_4.html web
https://github.com/wazuh/wazuh/releases/tag/v4.0.4 web