Description
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Wazuh wazuh-agent
Default version status: unaffected
4.3.0 to < 4.14.8affected4.14.8unaffected
pkg:github/wazuh/wazuh