CVE-2024-32038 - OpenCVE

Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-04-19T14:31:00.581Z

Updated: 2024-08-02T02:06:42.823Z

Reserved: 2024-04-09T15:29:35.939Z

Link: CVE-2024-32038

Vulnrichment

Updated: 2024-08-02T02:06:42.823Z

NVD

Status : Awaiting Analysis

Published: 2024-04-19T15:15:50.610

Modified: 2024-04-19T16:19:49.043

Link: CVE-2024-32038

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32038", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-09T15:29:35.939Z", "datePublished": "2024-04-19T14:31:00.581Z", "dateUpdated": "2024-08-02T02:06:42.823Z"}, "containers": {"cna": {"title": "Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327"}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"version": ">= 3.8.0, < 4.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-19T14:31:00.581Z"}, "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2."}], "source": {"advisory": "GHSA-fcpw-v3pg-c327", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-19T18:15:13.546008Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wazuh:wazuh_manager:3.8.0:*:*:*:*:*:*:*"], "vendor": "wazuh", "product": "wazuh_manager", "versions": [{"status": "affected", "version": "3.8.0", "lessThan": "4.7.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:52:06.098Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:06:42.823Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:06:42.823Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-19T18:15:13.546008Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wazuh:wazuh_manager:3.8.0:*:*:*:*:*:*:*"], "vendor": "wazuh", "product": "wazuh_manager", "versions": [{"status": "affected", "version": "3.8.0", "lessThan": "4.7.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-19T18:14:47.759Z"}}], "cna": {"title": "Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"advisory": "GHSA-fcpw-v3pg-c327", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": ">= 3.8.0, < 4.7.2"}]}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. There is a buffer overflow hazard in wazuh-analysisd when handling Unicode characters from Windows Eventchannel messages. It impacts Wazuh Manager 3.8.0 and above. This vulnerability is fixed in Wazuh Manager 4.7.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-19T14:31:00.581Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32038", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:06:42.823Z", "dateReserved": "2024-04-09T15:29:35.939Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-19T14:31:00.581Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}