4.8Mittel
CVE-2025-15612Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE
Beschreibung
Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| citrix | provisioning | 4.1.3 – | |
| wazuh | wazuh | 4.1.3 – < 4.14.0 | |
| Wazuh | Wazuh Provisioning Scripts (Agent Build Environment) | >=4.1.3, fixed >=4.14.0 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-wvg9-7q49-c7mg) vendor-advisoryExploitVendor Advisory
- https://www.vulncheck.com/advisories/various-uses-of-curl-without-verifying-the-authenticity-of-the-ssl-certi… third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*≥ 4.1.3 < 4.14.0