--- title: "Security digest: November 8, 2023" url: https://erroneo.us/security/2023-11-08/ description: "November 8, 2023 vulnerability digest: 1 CISA KEV addition (IETF); 2 critical advisories (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2023-11-08 date_modified: 2023-11-08 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: November 8, 2023 1 known exploited (cisa kev) addition and 2 critical advisories. ## Take stock - Do you run any of these? IETF Service Location Protocol (SLP). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-11-29. - Maven: 2 critical advisories ( org.xwiki.platform:xwiki-platform-flamingo-skin-resources , org.xwiki.platform:xwiki-platform-administration-ui , org.xwiki.platform:xwiki-platform-administration ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2023-29552](https://erroneo.us/security/cve/CVE-2023-29552/index.md) IETF Service Location Protocol (SLP): Service Location Protocol (SLP) Denial-of-Service Vulnerability (CISA due 2023-11-29) ## Critical advisories - [CVE-2023-46732](https://erroneo.us/security/cve/CVE-2023-46732/index.md) XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu — Maven org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 9.7-rc-1, < 14.10.14 → 14.10.14; Maven org.xwiki.platform:xwiki-platform-flamingo-skin-resources >= 15.0-rc-1, < 15.5.1 → 15.5.1 - [CVE-2023-46731](https://erroneo.us/security/cve/CVE-2023-46731/index.md) XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest — Maven org.xwiki.platform:xwiki-platform-administration-ui < 14.10.14 → 14.10.14; Maven org.xwiki.platform:xwiki-platform-administration-ui >= 15.0-rc-1, < 15.5.1 → 15.5.1; Maven org.xwiki.platform:xwiki-platform-administration < 14.10.14 → 14.10.14 --- Source page: https://erroneo.us/security/2023-11-08/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt