4.8Media
CVE-2025-15612Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE
Descripción
Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| citrix | provisioning | 4.1.3 – | |
| wazuh | wazuh | 4.1.3 – < 4.14.0 | |
| Wazuh | Wazuh Provisioning Scripts (Agent Build Environment) | >=4.1.3, fixed >=4.14.0 |
Referencias y parches
- GitHub Security Advisory (GHSA-wvg9-7q49-c7mg) vendor-advisoryExploitVendor Advisory
- https://www.vulncheck.com/advisories/various-uses-of-curl-without-verifying-the-authenticity-of-the-ssl-certi… third-party-advisoryThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*≥ 4.1.3 < 4.14.0