{"id":16417,"date":"2023-02-25T09:26:24","date_gmt":"2023-02-25T16:26:24","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=16417"},"modified":"2023-03-16T09:53:24","modified_gmt":"2023-03-16T16:53:24","slug":"dhs-cisa-kevs-weekly-edition-27-patch-before-you-hit-the-deadline","status":"publish","type":"patch_watch","link":"https:\/\/10.42.32.162\/patch_watch\/dhs-cisa-kevs-weekly-edition-27-patch-before-you-hit-the-deadline\/","title":{"rendered":"DHS CISA KEVs Weekly Edition 27: Patch Before You Hit the Deadline"},"content":{"rendered":"<p>The US CyberSecurity and Infrastructure Security Agency (CISA) has been close ly following threat actors, new variants, and the vulnerabilities that are being exploited in the wild. Based on these, CISA added 18 vulnerabilities in the first two months of 2023.\u00a0 In this blog, we will take a look at the vulnerabilities that CISA requires the federal agencies to patch by February 28, 2023. From our analysis, we have found:<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-16418 size-large\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/patchwatch_27_image1-1024x559.png\" alt=\"\" width=\"640\" height=\"349\" srcset=\"https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image1-1024x559.png 1024w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image1-300x164.png 300w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image1-768x419.png 768w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image1-1536x839.png 1536w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image1.png 2000w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Why are these CVEs important?<\/h2>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">All 7 vulnerabilities are weaponized and have been exploited in the wild.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21674\">CVE-2023-21674<\/a>\u00a0and\u00a0<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-41080\">CVE-2022-41080<\/a>\u00a0are Microsoft privilege escalation vulnerabilities. CVE-2022-41080 chained with the ProxyNotShell vulnerability CVE-2022-41082 is exploited by attackers to achieve privilege escalation through Outlook Web Access (OWA).<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-21587\">CVE-2022-21587<\/a>\u00a0is a vulnerability in Oracle Business Suite that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-47966\">CVE-2022-47966<\/a>\u00a0affects multiple Zoho ManageEngine products. It is an unauthenticated remote code execution vulnerability caused by the usage of an outdated third-party dependency, Apache Santuario.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-11357\">CVE-2017-11357<\/a>\u00a0is a vulnerability in RadAsyncUpload, Telerik that can result in file uploads in a limited location and\/or remote code execution if exploited.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Multiple SugarCRM products contain a remote code execution vulnerability,\u00a0<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-22952\">CVE-2023-22952<\/a>\u00a0in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-44877\">CVE-2022-44877<\/a>\u00a0is a CWP Control Web Panel (formerly CentOS Web Panel) OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.<\/p>\n<\/li>\n<\/ul>\n<h2 dir=\"ltr\">How Far Back Do They Go?<\/h2>\n<p>Only the Telerik vulnerability dates back to 2017. Rest of the vulnerabilities were discovered in 2022 and 2023. The Telerik vulnerability was trending recently which prompted CISA to add it to the KEV catalog.<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-16419 size-large\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/patchwatch_27_image2-1024x724.png\" alt=\"\" width=\"640\" height=\"453\" srcset=\"https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image2-1024x724.png 1024w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image2-300x212.png 300w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image2-768x543.png 768w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image2.png 1500w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Which Vendors Are Affected?<\/h2>\n<p dir=\"ltr\">Multiple vendors including CWP and Oracle are affected. CVE-2023-22952 is a SugarCRM vulnerability that is actively exploited with crypto mining malware.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter wp-image-16420 size-large\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/patchwatch_27_image3-1024x682.png\" alt=\"\" width=\"640\" height=\"426\" srcset=\"https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image3-1024x682.png 1024w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image3-300x200.png 300w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image3-768x512.png 768w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image3-1536x1023.png 1536w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image3.png 2044w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<h2 dir=\"ltr\">Severity Scores<\/h2>\n<p>Most vulnerabilities are ranked critical on the CVSS scale. CVE-2022-47966 has a CVSS score of 9.8. It is trending currently as attackers are exploiting this vulnerability to deploy a new ransomware strain, Buhti. It is also used in targeted cyber espionage attacks.<\/p>\n<p><img decoding=\"async\" class=\"wp-image-16421 size-large aligncenter\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/patchwatch_27_image4-1024x849.png\" alt=\"\" width=\"640\" height=\"531\" srcset=\"https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image4-1024x849.png 1024w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image4-300x249.png 300w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image4-768x637.png 768w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image4.png 1500w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Software Weaknesses<\/h2>\n<p dir=\"ltr\">Each vulnerability is caused due to a flaw in the software design or implementation. The Telerik vulnerability (CVE-2017-11357) which was discovered in 2017 is due to insecure direct object reference.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter wp-image-16422 size-large\" src=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/patchwatch_27_image5-1024x625.png\" alt=\"\" width=\"640\" height=\"391\" srcset=\"https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image5-1024x625.png 1024w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image5-300x183.png 300w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image5-768x468.png 768w, https:\/\/10.42.32.162\/wp-content\/uploads\/2023\/03\/patchwatch_27_image5.png 1500w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>CVE-2022-41080, CVE-2022-21587, and CVE-2023-21674 do not have any CWEs associated with them.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><iframe class=\"airtable-embed\" src=\"https:\/\/airtable.com\/embed\/shrBjt8YSKD2gNdwT?backgroundColor=blue&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\" data-mce-fragment=\"1\"><\/iframe><\/p>\n<p dir=\"ltr\">Table: DHS CISA KEVs<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>We urge organizations to implement patches for these CVEs at the earliest. With Securin\u2019s threat-based approach and vulnerability intelligence, security teams can prioritize the threats, including all KEVs, and minimize their attack surface.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">For the latest news regarding vulnerabilities that are exploited and critical threats, read our blog on\u00a0Weekly Threat Intelligence.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The US CyberSecurity and Infrastructure Security Agency (CISA) has been close ly following threat actors, new variants, and the vulnerabilities that are being exploited in the wild. Based on these, CISA added 18 vulnerabilities in the first two months of 2023.\u00a0 In this blog, we will take a look at the vulnerabilities that CISA requires [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14436,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch\/16417"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/14436"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=16417"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_category?post=16417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}