Vulnerability Details : CVE-2022-40497
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.
Vulnerability category: Execute code
Products affected by CVE-2022-40497
- cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
- cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
- cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-40497
1.51%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-40497
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
References for CVE-2022-40497
-
https://github.com/wazuh/wazuh/pull/14801
Fix arbitrary code execution flaw in Active Response by vikman90 · Pull Request #14801 · wazuh/wazuh · GitHubPatch;Third Party Advisory
Jump to