Moltenbit

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.0.0 through 4.14.5 **Description** An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate the node name provided in the cluster hello payload. An attacker possessing a valid cluster Fernet key can provide a traversal-shaped node name and then disconnect, which triggers the master's peer cleanup routine to remove the specified directories. Path traversal is a technique used to access files or directories outside the intended folder by using special characters like dot-dot-slash. **Recommendations** Update Wazuh to version 4.14.6 or later.

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.4.0 through 4.14.6 **Description** A denial of service issue exists in the `fdecompress files()` function within `cluster.py`. Authenticated cluster peers possessing a valid cluster Fernet key can trigger memory exhaustion and service disruption on the master node by uploading a malicious synchronization archive. This is achieved using a zip bomb, which is a small, highly compressed archive that expands to a massive size when decompressed, forcing `wazuh-clusterd` to load the full payload into memory due to a lack of decompressed size limits. **Recommendations** Update to version 4.14.7 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** Server-Side Request Forgery (SSRF) occurs during the repository migration process via HTTP Redirect. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.