<\/div>\n

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog.<\/h2>\n\n\n\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added<\/a> the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog<\/a>:<\/p>\n\n\n\n

\n
• CVE-2024-23692<\/a> Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability<\/li>\n\n\n\n
• CVE-2024-38080<\/a> Microsoft Windows Hyper-V Privilege Escalation Vulnerability<\/li>\n\n\n\n
• CVE-2024-38112<\/a> Microsoft Windows MSHTML Platform Spoofing Vulnerability<\/li>\n<\/ul>\n\n\n\n

  Below are the descriptions of the flaws added to the KEV catalog:<\/gwmw><\/p>\n\n\n\n

  CVE-2024-23692<\/a> (CVSS score of 9.8) – the flaw is a template injection vulnerability that impacts Rejetto HTTP File Server, up to and including version 2.3m. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.<\/p>\n\n\n\n

  CVE-2024-38080<\/a> (CVSS score of 7.8) – the flaw is an elevation of privilege vulnerability in Windows Hyper-V. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.<\/p>\n\n\n\n

  CVE-2024-38112<\/a> (CVSS score of 7.5) – the flaw is a Windows MSHTML Platform Spoofing Vulnerability. Microsoft states<\/a> that successfully exploiting this vulnerability requires an attacker to take additional actions before exploitation to prepare the target environment. An attacker can trigger the issue by sending a malicious file to the victims that would have to execute it.<\/p>\n\n\n\n

  According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n

  CISA orders federal agencies to fix this vulnerability by July 30, 2024.<\/p>\n\n\n\n

  Last week, the U.S. Cybersecurity and Infrastructure Security Agency added<\/a>\u00a0a Cisco NX-OS Command Injection Vulnerability, tracked as\u00a0CVE-2024-20399<\/a>, to its\u00a0Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/gwmw><\/gwmw><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a> \u2013<\/strong> hacking, CISA<\/a>)<\/strong><\/gwmw><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the descriptions of the flaws added to the KEV catalog: CVE-2024-23692 (CVSS score […]<\/p>\n","protected":false},"author":1,"featured_media":106349,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[4112,9508,9506,10918,687,841,1533],"class_list":["post-165513","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n