CVE-2025-64483: Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint
Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint. These credentials can be used to register new agents within the same Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuh API – Agent Configurationto a version that resolves this vulnerability.Fixed in 4.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64483?
CVE-2025-64483 is classified as a high severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2025-64483?
To fix CVE-2025-64483, upgrade the Wazuh API to version 4.13.0 or later.
What systems are affected by CVE-2025-64483?
CVE-2025-64483 affects Wazuh API versions from 4.9.0 up to, but not including, 4.13.0.
What type of vulnerability is CVE-2025-64483?
CVE-2025-64483 is an authentication-related vulnerability that allows unauthorized retrieval of agent credentials.
Can authenticated users exploit CVE-2025-64483?
Yes, authenticated users with read-only API roles can exploit CVE-2025-64483 to access agent enrollment credentials.