PT-2026-28280 · Wazuh · Wazuh 4.12.0
CVSS v4.0
8.3
Alta
| Vetor | AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Wazuh version 4.12.0
Description
Wazuh version 4.12.0 has an issue where the
GITHUB TOKEN can be extracted from uploaded artifacts in GitHub Actions workflows. This allows attackers to potentially perform unauthorized actions, such as pushing malicious commits or altering release tags, within a limited timeframe.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Insufficiently Protected Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wazuh 4.12.0