CVE-2024-47770 json
Ability to view Agent list with no privilege access in wazuh-dashboard
published 2025-02-03 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-42888 , GHSA-648q-8m78-5cwv , GO-2025-3445
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. This vulnerability occurs when the system has weak privilege access, that allows an attacker to do privilege escalation. In this case the attacker is able to view agent list on Wazuh dashboard with no privilege access. This issue has been addressed in release version 4.9.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- go github.com/wazuh/wazuh 4.9.1+incompatible
- wazuh wazuh 4.9.1
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250207T224745-150000.1.32.1
suse advisories SUSE-SU-2025:0429-1
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250204T220613-1.1
opensuse advisories openSUSE-SU-2025:14732-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/wazuh/wazuh/security/advisories/GHSA-648q-8m78-5cwv referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/wazuh/wazuh | <4.9.1+incompatible |
4.9.1+incompatible |
Affected products
- wazuh wazuh
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/wazuh/wazuh/security/advisories/GHSA-648q-8m78-5cwv
exploit, vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-47770
advisory
Sources
- CVE List CVE-2024-47770
- NVD CVE-2024-47770
- OSV GO-2025-3445
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.