Here are the CVE updates for the week of December 9th through the 15th.
Critical Severity Vulnerabilities
Server-Side Request Forgery (SSRF) in Adobe Document Service | CVE-2024-47578
Description: Adobe Document Service is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. An attacker with administrator privileges can exploit this by sending a crafted request through the web application, allowing access to internal systems protected by firewalls. Exploitation could result in unauthorized file access, file modification, or even system unavailability.
Potential Impacts:
- Unauthorized File Access: Attackers can read sensitive or confidential files.
- Data Modification: Exploitation can result in tampering with critical system files.
- System Downtime: Successful exploitation could lead to a denial of service, rendering the application unavailable.
- Escalation of Access: Internal system access could provide a foothold for further attacks.
Mitigation Recommendations:
- Update Software: Ensure that Adobe Document Service is updated to the latest patched version.
- Restrict Administrator Access: Limit admin privileges to trusted personnel only and monitor admin activities.
- Validate Inputs: Implement robust input validation to prevent malicious requests.
- Network Segmentation: Isolate critical systems from web application access to limit potential exposure.
- Monitor Logs: Regularly review logs for suspicious activity targeting SSRF vulnerabilities.
Authentication Bypass in Sign In With Google Plugin for WordPress | CVE-2024-11015
Description: The Sign In With Google plugin for WordPress is vulnerable to an authentication bypass affecting all versions up to and including 1.8.0. The vulnerability is caused by insufficient null value checks in the authenticate_user function when handling access tokens and user information. This flaw allows unauthenticated attackers to log in as the first user registered with Google OAuth, which is often the site administrator, potentially giving the attacker full administrative access to the site.
Potential Impacts:
- Unauthorized Administrative Access: Attackers could take over the site by gaining administrator privileges.
- Data Breach: Attackers may access and potentially exfiltrate sensitive user or site data.
- Site Defacement or Malicious Changes: Exploitation could result in site defacement, deletion of critical data, or injection of malicious content.
- Security Risks to Users: Compromised sites could lead to further attacks on visitors through phishing, malware injection, or data theft.
Mitigation Recommendations:
- Update the Plugin: Upgrade to a patched version of the Sign In With Google plugin when it becomes available.
- Disable Plugin Temporarily: If a patch is not yet available, consider disabling the plugin to prevent unauthorized logins.
- Restrict Google OAuth Usage: Limit Google OAuth sign-in to only trusted users until the issue is resolved.
- Monitor Site Logs: Regularly review logs for unusual login activities or signs of unauthorized access.
- Implement Multi-Factor Authentication (MFA): Add an additional layer of authentication to secure administrative accounts.
- Review Administrative Accounts: Check for any unauthorized changes or newly added administrator accounts and remove them promptly.
High Severity Vulnerabilities
Unrestricted File Upload and Download Vulnerability in Cleo Harmony, VLTrader, and LexiCom | CVE-2024-9508: Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21 are affected by a critical vulnerability involving unrestricted file upload and download functionality. This flaw enables attackers to exploit the software for remote code execution (RCE). The vulnerability stems from inadequate controls over file management operations, allowing attackers to upload.
Elevation of Privilege in Windows Common Log File System (CLFS) Driver | CVE-2024-49138: This vulnerability, identified as CVE-2024-49138, affects the Windows Common Log File System (CLFS) Driver. It allows attackers to elevate their privileges on the affected system. With a CVSSv3 score of 7.8, it is rated as important. The vulnerability was exploited as a zero-day in the wild, though details regarding the exploitation methods or scenarios are not yet available.
Improper Input Validation in Dell Client Platform BIOS | CVE-2024-47238: Dell Client Platform BIOS is vulnerable to an improper input validation issue in an externally developed component. This flaw allows a high-privileged attacker with local access to exploit the vulnerability, potentially enabling arbitrary code execution. The vulnerability lies in the way inputs are processed, allowing malicious manipulation to execute unauthorized operations.
Memory Corruption Vulnerability in Horner Automation Cscape | CVE-2024-9508: Horner Automation Cscape is affected by a memory corruption vulnerability. This issue could allow an attacker to manipulate memory in a way that enables the disclosure of sensitive information or the execution of arbitrary code. The vulnerability is rooted in how memory is managed during the application’s operations, potentially leading to severe security breaches.
Medium Severity Vulnerabilities
Privilege Escalation in SAP NetWeaver Application Server for ABAP | CVE-2024-47585: This vulnerability exists in SAP NetWeaver Application Server for ABAP and ABAP Platform. It allows an authenticated attacker to escalate privileges due to improper authorization checks. Although the system distinguishes between import and export authorizations, a single authorization is applied for both, enabling attackers to gain unauthorized access levels. While the issue poses a risk of privilege escalation, it has no significant impact on the integrity or availability of the application and only a low impact on data confidentiality.
DOM-Based Cross-Site Scripting (XSS) Vulnerability in Adobe Experience Manager | CVE-2024-43738: Adobe Experience Manager (AEM) versions 6.5.21 and earlier are vulnerable to a DOM-based Cross-Site Scripting (XSS) flaw. This issue occurs when a web application processes data from an untrusted source and injects it into the DOM without sufficient sanitization. An attacker can exploit this vulnerability by tricking a victim into interacting with a malicious link or visiting a crafted page, leading to the execution of unintended script code in the victim’s browser or the alteration of the user interface.
Out-of-Bounds Read Vulnerability in Adobe Acrobat Reader | CVE-2024-49534: Adobe Experience Manager (AEM) versions 6.5.21 and earlier are vulnerable to a DOM-based Cross-Site Scripting (XSS) flaw. This issue occurs when a web application processes data from an untrusted source and injects it into the DOM without sufficient sanitization. An attacker can exploit this vulnerability by tricking a victim into interacting with a malicious link or visiting a crafted page, leading to the execution of unintended script code in the victim’s browser or the alteration of the user interface.