The U.S. Cybersecurity and Infrastructure Security Company (CISA) has extra a security flaw impacting the Microsoft Sharepoint Server to its Regarded Exploited Vulnerabilities (KEV) catalog based mostly on evidence of active exploitation in the wild.
The vulnerability, tracked as CVE-2023-24955 (CVSS rating: 7.2), is a critical distant code execution flaw that permits an authenticated attacker with Internet site Proprietor privileges to execute arbitrary code.
“In a network-based attack, an authenticated attacker as a Website Proprietor could execute code remotely on the SharePoint Server,” Microsoft explained in an advisory. The flaw was addressed by Microsoft as element of its Patch Tuesday updates for May 2023.
The progress will come a lot more than two months right after CISA included CVE-2023-29357, a privilege escalation flaw in SharePoint Server, to its KEV catalog.
It can be really worth pointing out that an exploit chain combining CVE-2023-29357 and CVE-2023-24955 was demonstrated by StarLabs SG at the Pwn2Personal Vancouver hacking contest past year, earning the researchers a $100,000 prize.
That claimed, there is now no data on the assaults weaponizing these two vulnerabilities and the threat actors that may well be exploiting them.
Microsoft formerly told The Hacker Information that “prospects who have enabled automated updates and permit ‘Receive updates for other Microsoft products’ selection within just their Windows Update settings are presently protected.”
Federal Civilian Govt Branch (FCEB) agencies are needed to implement the fixes by April 16, 2024, to protected their networks against lively threats.
Located this short article intriguing? Comply with us on Twitter and LinkedIn to browse additional unique information we publish.
Some parts of this article are sourced from:
thehackernews.com
Microsoft Edge Bug Could Have Allowed Attackers to Silently Install Malicious Extensions