The U.S. Cybersecurity and Infrastructure Security Agency has appended four weaknesses to its compilation of Recognized Exploited Vulnerabilities, urging federal entities to promptly act. While the directive focuses mainly on Federal Civilian Executive Branch organizations, the announcement acts as a stimulus for all establishments to evaluate their security stance and safeguard against emerging digital hazards.
What are the four vulnerabilities?
The four weaknesses are:
- CVE-2024-45195: A direct request (or ‘Forced Browsing’) weakness found in the Apache OFBiz ERP system. This weakness, which was fixed in September 2024, allows a malicious actor to execute arbitrary code on the server using URLs, scripts, or files.
- CVE-2024-29059: A .NET Framework Information Disclosure Weakness in the Microsoft .NET Framework versions 3.5 and 4.8. Specifically, it could generate an error message revealing sensitive details like passwords or the complete path of the installed application. The error could arise in various forms, automatically triggered by the source code or by a language interpreter or external component. The weakness was fixed in March 2024.
- CVE-2018-9276: A flaw in PRTG Network Monitor that permits a malicious actor with administrative privileges on the PRTG System Administrator to exploit an OS command injection vulnerability. This was rectified in 2018.
- CVE-2018-19410 represents another vulnerability in PRTG Network Monitor. By exploiting this, an attacker can deploy HTTP requests and carry out a Local File Inclusion assault to create users with read-write permissions (including administrator). This was addressed in 2018.
SEE: The U.K. has introduced a pioneering Cyber Code of Practice to assist developers, system operators, and organizations in securely managing AI.
“These kinds of weaknesses are common entry points for malicious digital offenders and pose substantial risks to the federal body,” stated CISA in its alert.
Monitoring recognized exploited vulnerabilities can fortify an entity’s overall security stance. In this instance, the software companies have rectified the vulnerabilities — sometimes years ago — and users are not required to take any action. Furthermore, these vulnerabilities underscore the significance of adhering to and reporting security in vital sectors.
About Author
