---
title: "Security digest: October 16, 2023"
url: https://erroneo.us/security/2023-10-16/
description: "October 16, 2023 vulnerability digest: 1 brief (Cisco IOS XE Web UI Zero-Day Chain Implants…); 1 CISA KEV addition (Cisco); 4 critical advisories (Maven…"
type: security-digest-day
section: "Security Digest"
date_published: 2023-10-16
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 16, 2023

1 editorial brief, 1 known exploited (cisa kev) addition and 4 critical advisories.

## Take stock

- Act now: Cisco IOS XE Web UI Zero-Day Chain Implants Devices . Operators of Cisco IOS XE switches, routers and wireless controllers with `ip http server` or `ip http secure-server` enabled, especially where the web UI faces the internet.
- Do you run any of these? Cisco IOS XE Web UI. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-10-20.
- Maven: 2 critical advisories ( org.apache.inlong:manager-pojo , org.xwiki.contrib.changerequest:application-changerequest-ui ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 1 critical advisory ( cachethq/cachet ). Check with composer audit .
- npm: 1 critical advisory ( @babel/traverse , babel-traverse ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Cisco IOS XE Web UI Zero-Day Chain Implants Devices](https://erroneo.us/security/briefs/cisco-ios-xe-web-ui-cve-2023-20198/index.md): If any IOS XE device has its HTTP or HTTPS server reachable from an untrusted network and is not on a fixed release, treat it as compromised until proven otherwise; devices with the web UI disabled were never exposed.

## Known exploited (CISA KEV)

- [CVE-2023-20198](https://erroneo.us/security/cve/CVE-2023-20198/index.md) Cisco IOS XE Web UI: Cisco IOS XE Web UI Privilege Escalation Vulnerability (CISA due 2023-10-20)

## Critical advisories

- [CVE-2023-43668](https://erroneo.us/security/cve/CVE-2023-43668/index.md) Authorization Bypass in Apache InLong — Maven org.apache.inlong:manager-pojo >= 1.4.0, < 1.9.0 → 1.9.0
- [CVE-2023-43661](https://erroneo.us/security/cve/CVE-2023-43661/index.md) Cachet vulnerable to Authenticated Remote Code Execution — Composer (PHP) cachethq/cachet < 2.4 → 2.4
- [CVE-2023-45138](https://erroneo.us/security/cve/CVE-2023-45138/index.md) XWiki Change Request Application UI XSS and remote code execution through change request title — Maven org.xwiki.contrib.changerequest:application-changerequest-ui >= 0.11, < 1.9.2 → 1.9.2
- [CVE-2023-45133](https://erroneo.us/security/cve/CVE-2023-45133/index.md) Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code — npm @babel/traverse < 7.23.2 → 7.23.2; npm @babel/traverse >= 8.0.0-alpha.0, < 8.0.0-alpha.4 → 8.0.0-alpha.4; npm babel-traverse < 7.23.2 → no fix

---
Source page: https://erroneo.us/security/2023-10-16/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt