<\/div>\n

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a SolarWinds Web Help Desk bug to its Known Exploited Vulnerabilities catalog.<\/h2>\n\n\n\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> SolarWinds Web Help Desk deserialization of untrusted data vulnerability, tracked as CVE-2024-28986<\/a>\u00a0(CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/p>\n\n\n\n

This week SolarWinds fixed<\/a> the vulnerability\u00a0in SolarWinds\u2019 Web Help Desk solution\u00a0for customer support. The flaw is a Java deserialization issue that an attacker can exploit to run commands on a vulnerable host leading to remote code execution.<\/p>\n\n\n\n

SolarWinds describes WHD as an affordable Help Desk Ticketing and Asset Management Software that is widely used by large enterprises and government organizations.<\/p>\n\n\n\n

\u201cSolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.\u201d reads the advisory<\/strong><\/a> published by Solarwinds. \u201cHowever, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.\u201d<\/em><\/p>\n\n\n\n

The vulnerability CVE-2024-28986 impacts all Web Help Desk versions. The software firm urges customers to upgrade to WHD 12.8.3 all versions of Web Help Desk (WHD), and then install the hotfix<\/a>.<\/p>\n\n\n\n

The vulnerability was discovered by researchers at the company\u2019s security firm. The company also thanked Inmarsat Government\/Viasat for their assistance.<\/gwmw><\/p>\n\n\n\n

Users can find a step-by-step procedure to install the hotfix\u00a0here<\/strong><\/a>.<\/gwmw><\/p>\n\n\n\n

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/p>\n\n\n\n

Experts recommend also private organizations review the\u00a0Catalog<\/a>\u00a0and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n

CISA orders federal agencies to fix this vulnerability by\u00a0September 5, 2024.<\/p>\n\n\n\n

Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/p>\n\n\n\n

Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, US CISA Known Exploited Vulnerabilities catalog)<\/strong><\/gwmw><\/gwmw><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a SolarWinds Web Help Desk bug to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added SolarWinds Web Help Desk deserialization of untrusted data vulnerability, tracked as CVE-2024-28986\u00a0(CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. This week SolarWinds fixed the […]<\/p>\n","protected":false},"author":1,"featured_media":106349,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[8913,4112,9508,9506,10918,12584,687,841,1533],"class_list":["post-167157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-cisa","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-known-exploited-vulnerabilities-catalog","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n