Full Report
CISA adds four new vulnerabilities to its catalog, urging agencies to remediate risks. Learn about the latest exploits and how they impact enterprise security.
Analysis Summary
As a vulnerability research specialist, I have summarized the relevant information from the provided article concerning CISA's recent updates to the Known Exploited Vulnerabilities catalog. Please note that the provided text details *three* specific CVEs, not four, and the severity scores and full exploitation status for all are not always explicit for every entry based solely on this summary.
# Vulnerability: Multiple Flaws Added to CISA KEV Catalog (Apache OFBiz, .NET Framework, PRTG)
## CVE Details
- CVE ID: CVE-2024-45195
- CVSS Score: Not explicitly stated.
- CWE: Direct request ('Forced Browsing') (for CVE-2024-45195)
- CVE ID: CVE-2024-29059
- CVSS Score: Not explicitly stated.
- CWE: Information Disclosure (for CVE-2024-29059)
- CVE ID: CVE-2018-9276
- CVSS Score: Not explicitly stated.
- CWE: OS Command Injection (for CVE-2018-9276)
## Affected Systems
- **Products:** Apache OFBiz ERP system, Microsoft .NET Framework, PRTG Network Monitor.
- **Versions:**
- Apache OFBiz: Versions prior to the September 2024 patch.
- .NET Framework: Versions 3.5 and 4.8.
- PRTG Network Monitor: Specific version information redacted in the summary, but the nature implies versions prior to patching.
- **Configurations:**
- CVE-2018-9276 specifically requires administrative access to the PRTG System Administrator context.
## Vulnerability Description
The article highlights three distinct vulnerabilities added to CISA's catalog:
1. **CVE-2024-45195 (Apache OFBiz - Forced Browsing):** Allows a threat actor to use malicious URLs or scripts to execute arbitrary code on the server.
2. **CVE-2024-29059 (.NET Framework - Information Disclosure):** An error condition in the .NET Framework can trigger error messages that expose sensitive data, such as passwords or full application installation pathnames.
3. **CVE-2018-9276 (PRTG Network Monitor - Command Injection):** Allows a threat actor, *who already possesses administrative access* within the PRTG System Administrator context, to perform OS command injection.
## Exploitation
- **Status:** All added to the CISA Known Exploited Vulnerabilities (KEV) catalog, implying they are actively exploited or pose a significant risk justifying mandatory remediation by Federal agencies.
- **Complexity:**
- CVE-2024-45195: Likely Low/Medium, as it involves URL manipulation.
- CVE-2024-29059: Depends on triggering the error message.
- CVE-2018-9276: Requires pre-existing administrative access, increasing the effective barrier for initial compromise but making exploitation easier once access is gained.
- **Attack Vector:** Network (for CVE-2024-45195, likely; CVE-2024-29059, likely network-accessible exploitation path). Local/Privilege Escalation (CVE-2018-9276, assuming administrative access is the prerequisite).
## Impact
Since these are KEV entries, the implied impact is High across the board unless specified otherwise.
- **Confidentiality:** High (Exposure via Info Disclosure and potential RCE payload access).
- **Integrity:** High (Arbitrary Code Execution via CVE-2024-45195, OS Command Injection via CVE-2018-9276).
- **Availability:** High (RCE or Command Injection can lead to service disruption).
## Remediation
### Patches
- **CVE-2024-45195 (Apache OFBiz):** Patched in September 2024. Agencies must update to the fixed version.
- **CVE-2024-29059 (.NET Framework):** Patched in March 2024. Agencies must apply the relevant .NET Framework security updates (3.5 and 4.8).
- **CVE-2018-9276 (PRTG):** A patch exists, as the vulnerability was publicly known, though specific version numbers are not listed here.
### Workarounds
No specific workarounds were detailed in the provided text excerpt. However, general workarounds would include:
* Disabling vulnerable components or services until patching is complete.
* Network segmentation to limit external access to the affected applications.
## Detection
- **Indicators of Compromise (IoCs):** Not explicitly listed. IoCs would involve monitoring for unusual GET/POST requests matching known exploitation patterns for Forced Browsing (CVE-2024-45195) or unusual system calls originating from the .NET process or PRTG service context (CVE-2018-9276).
- **Detection Methods and Tools:** CISA mandates remediation, suggesting that monitoring systems like EDR/SIEM should be configured to look for activity related to these CVEs as soon as vendor-specific signatures become available.
## References
- Vendor advisories for Apache Software Foundation, Microsoft, and Paessler (PRTG).
- CISA Known Exploited Vulnerabilities Catalog.
- Relevant links (defanged):
- hxxps://www.techrepublic.com/article/cisa-vulnerabilities-catalog-update/