CVE-2021-26814: Improper Input Validation

March 18, 2021

Wazuh API in Wazuh from to allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service script.

References

documentation.wazuh.com/4.0/release-notes/release_4_0_4.html
github.com/advisories/GHSA-w36g-q975-37rg
github.com/wazuh/wazuh/releases/tag/v4.0.4
nvd.nist.gov/vuln/detail/CVE-2021-26814

Code Behaviors & Features

Detect and mitigate CVE-2021-26814 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →