CVE-2023-42455

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the API, even if their dashboard role is not. Version 4.4.2 contains a fix. There are no known workarounds.

• CWE-639
• CWE-639

• https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427Issue Tracking
• https://github.com/wazuh/wazuh-kibana-app/pull/5428Patch
• https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjfPatch, Vendor Advisory
• https://github.com/wazuh/wazuh-dashboard-plugins/issues/5427Issue Tracking
• https://github.com/wazuh/wazuh-kibana-app/pull/5428Patch
• https://github.com/wazuh/wazuh-kibana-app/security/advisories/GHSA-8w7x-52r7-qvjfPatch, Vendor Advisory

Published

Oct 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4245The WooCommerce PDF Invoice Builder for WordPress is vulnera…4.3
• CVE-2023-42450Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42451Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42452Mastodon is a free, open-source social network server based …5.4
• CVE-2023-42453Synapse is an open-source Matrix homeserver written and main…4.3
• CVE-2023-42454SQLpage is a SQL-only webapp builder. Someone using SQLpage …9.1
• CVE-2023-42456Sudo-rs, a memory safe implementation of sudo and su, allows…8.1
• CVE-2023-42457plone.rest allows users to use HTTP verbs such as GET, POST,…7.5
• CVE-2023-42458Zope is an open-source web application server. Prior to vers…5.4
• CVE-2023-42459Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2023-4246The GiveWP plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2023-42460Vyper is a Pythonic Smart Contract Language for the EVM. The…7.5