CVE-2025-15612

Katalog CVE

CVSS 8.1 · High EPSS 0,22%

Kerentanan Improper Certificate Validation pada wazuh. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wazuh/wazuh/security/advisories/GHSA-wvg9-7q49-c7mg exploit · advisory vendor
• https://www.vulncheck.com/advisories/various-uses-of-curl-without-verifying-the-authenticity-of-the-ssl-certif... advisory pihak ketiga