{"id":16423,"date":"2023-03-14T09:47:26","date_gmt":"2023-03-14T16:47:26","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=16423"},"modified":"2023-03-16T09:52:55","modified_gmt":"2023-03-16T16:52:55","slug":"dhs-cisa-kevs-weekly-edition-28-patch-before-you-hit-the-deadline","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/dhs-cisa-kevs-weekly-edition-28-patch-before-you-hit-the-deadline\/","title":{"rendered":"DHS CISA KEVs Weekly Edition 28: Patch Before You Hit the Deadline"},"content":{"rendered":"<p>In this blog we will be taking a look at the CVEs that need to be patched by March 10, 2023. Let\u2019s look at the analysis of all the vulnerabilities below:<\/p>\n<p>&nbsp;<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-16424 size-large\" src=\"http:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-1024x697.png\" alt=\"\" width=\"640\" height=\"436\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-1024x697.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-300x204.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-768x523.png 768w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-1536x1046.png 1536w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-2048x1394.png 2048w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image1-220x150.png 220w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Why are these CVEs important?<\/h2>\n<p dir=\"ltr\">From our analysis, we found that<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">All 8 vulnerabilities are weaponized and have been exploited in the wild.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23376\">CVE-2023-23376<\/a>,\u00a0<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21823\">CVE-2023-21823<\/a>, and\u00a0<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21715\">CVE-2023-21715<\/a>\u00a0are Microsoft vulnerabilities that can be exploited to gain privilege escalation. All three vulnerabilities have publicly exposed exploit concepts.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23529\">CVE-2023-23529<\/a>\u00a0is Apple\u2019s type confusion issue that can be exploited for arbitrary code execution by getting the targeted user to access a malicious website. It is actively being exploited now.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-46169\">CVE-2022-46169<\/a>\u00a0is a critical command injection flaw found in the Cacti monitoring solution. It allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. Since an exploit for it was published, attackers have been actively exploiting this vulnerability in Cacti. CVE-2022-46169 was patched in December 2023.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-0669\">CVE-2023-0669<\/a>\u00a0is the much exploited Fortra GoAnywhere MFT Remote Code Execution Vulnerability. Clop ransomware has breached more than 130 organizations by exploiting this vulnerability.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-24990\">CVE-2022-24990<\/a>\u00a0is a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint. It has been exploited by North Korean threat actors in attacks on the healthcare sector.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-2291\">CVE-2015-2291<\/a>\u00a0is an Intel driver vulnerability. Russian threat actors exploited this vulnerability to load a malicious driver designed to reduce the token integrity of Microsoft Defender.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\" role=\"presentation\">\n<h2 dir=\"ltr\">How Far Back Do They Go?<\/h2>\n<p dir=\"ltr\">The Intel vulnerability CVE-2015-2291 which dates back to 2015 caught CISA\u2019s attention after the Russian APT groups exploited it in attacks. Other CVE were recently discovered and added to the KEV catalog.<\/p>\n<p dir=\"ltr\">\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter wp-image-16425 size-large\" src=\"http:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image2-1024x833.png\" alt=\"\" width=\"640\" height=\"521\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image2-1024x833.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image2-300x244.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image2-768x625.png 768w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image2-1536x1249.png 1536w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image2-2048x1666.png 2048w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p dir=\"ltr\">\n<h2 dir=\"ltr\">Which Vendors Are Affected?<\/h2>\n<p dir=\"ltr\">Microsoft has the most number of vulnerabilities (3) among the CISA CVEs.<\/p>\n<p dir=\"ltr\">\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter wp-image-16426 size-large\" src=\"http:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-1024x702.png\" alt=\"\" width=\"640\" height=\"439\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-1024x702.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-300x206.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-768x526.png 768w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-1536x1053.png 1536w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-2048x1404.png 2048w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image3-220x150.png 220w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p dir=\"ltr\">\n<h2 dir=\"ltr\">Severity Scores<\/h2>\n<p dir=\"ltr\">Most vulnerabilities are ranked high on the CVSS scale. CVE-2023-0669, the GoAnywhere MFT vulnerability is present in over 1000 admin consoles that are exposed on the internet.<\/p>\n<p dir=\"ltr\">\n<p dir=\"ltr\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-16427 size-large\" src=\"http:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image4-1024x870.png\" alt=\"\" width=\"640\" height=\"544\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image4-1024x870.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image4-300x255.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image4-768x653.png 768w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image4-1536x1305.png 1536w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image4-2048x1740.png 2048w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p dir=\"ltr\">\n<h2 dir=\"ltr\">Software Weaknesses<\/h2>\n<p dir=\"ltr\">Each vulnerability is caused due to a flaw in the software design or implementation.<\/p>\n<p dir=\"ltr\">\n<p dir=\"ltr\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-16428 size-large\" src=\"http:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image5-1024x837.png\" alt=\"\" width=\"640\" height=\"523\" srcset=\"https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image5-1024x837.png 1024w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image5-300x245.png 300w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image5-768x628.png 768w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image5-1536x1256.png 1536w, https:\/\/webdev.securin.xyz\/wp-content\/uploads\/2023\/03\/securin-patchwatch_28_image5.png 2009w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p dir=\"ltr\">\n<p dir=\"ltr\">CVE-2023-23376, CVE-2022-24990, and CVE-2023-21823 do not have any CWEs associated with them.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><iframe class=\"airtable-embed\" src=\"https:\/\/airtable.com\/embed\/shrFBV9OF6LDIFz82?backgroundColor=blue&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\" data-mce-fragment=\"1\"><\/iframe><\/p>\n<p dir=\"ltr\"><em>Table: DHS CISA KEVs<\/em><\/p>\n<p dir=\"ltr\">\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>We urge organizations to implement patches for these CVEs at the earliest. With Securin\u2019s threat-based approach and vulnerability intelligence, security teams can prioritize the threats, including all KEVs, and minimize their attack surface.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">\n<p dir=\"ltr\" style=\"text-align: center;\">For the latest news regarding vulnerabilities that are exploited and critical threats, read our blog on\u00a0Weekly Threat Intelligence.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this blog we will be taking a look at the CVEs that need to be patched by March 10, 2023. Let\u2019s look at the analysis of all the vulnerabilities below: &nbsp; &nbsp; Why are these CVEs important? From our analysis, we found that All 8 vulnerabilities are weaponized and have been exploited in the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14436,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/16423"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14436"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=16423"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=16423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}