U.S. CISA adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and Rejetto HTTP File Server bugs to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2024-23692 Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
• CVE-2024-38080 Microsoft Windows Hyper-V Privilege Escalation Vulnerability
• CVE-2024-38112 Microsoft Windows MSHTML Platform Spoofing Vulnerability

Below are the descriptions of the flaws added to the KEV catalog:

CVE-2024-23692 (CVSS score of 9.8) – the flaw is a template injection vulnerability that impacts Rejetto HTTP File Server, up to and including version 2.3m. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.

CVE-2024-38080 (CVSS score of 7.8) – the flaw is an elevation of privilege vulnerability in Windows Hyper-V. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2024-38112 (CVSS score of 7.5) – the flaw is a Windows MSHTML Platform Spoofing Vulnerability. Microsoft states that successfully exploiting this vulnerability requires an attacker to take additional actions before exploitation to prepare the target environment. An attacker can trigger the issue by sending a malicious file to the victims that would have to execute it.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by July 30, 2024.

Last week, the U.S. Cybersecurity and Infrastructure Security Agency added a Cisco NX-OS Command Injection Vulnerability, tracked as CVE-2024-20399, to its Known Exploited Vulnerabilities (KEV) catalog.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, CISA)