Pierluigi Paganini July 10, 2024

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)  the following vulnerabilities to its :

•  Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
•  Microsoft Windows Hyper-V Privilege Escalation Vulnerability
•  Microsoft Windows MSHTML Platform Spoofing Vulnerability

Below are the descriptions of the flaws added to the KEV catalog:

(CVSS score of 9.8) – the flaw is a template injection vulnerability that impacts Rejetto HTTP File Server, up to and including version 2.3m. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.

(CVSS score of 7.8) – the flaw is an elevation of privilege vulnerability in Windows Hyper-V. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

(CVSS score of 7.5) – the flaw is a Windows MSHTML Platform Spoofing Vulnerability. Microsoft that successfully exploiting this vulnerability requires an attacker to take additional actions before exploitation to prepare the target environment. An attacker can trigger the issue by sending a malicious file to the victims that would have to execute it.

According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend private organizations review the  and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by July 30, 2024.

Last week, the U.S. Cybersecurity and Infrastructure Security Agency added a Cisco NX-OS Command Injection Vulnerability, tracked as , to its .

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, CISA)