CVE-2025-15617

Katalog CVE

CVSS 8.1 · High EPSS 0,39%

Kerentanan Insufficiently Protected Credentials pada wazuh. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x exploit · advisory vendor
• https://www.vulncheck.com/advisories/exposure-of-the-github-token-in-wazuh-workflow-run-artifact advisory pihak ketiga