Digest · Friday
Security digest: December 15, 2023
6 critical advisories.
All digests · RSS · Markdown
Take stock
- Maven: 6 critical advisories (
org.xwiki.platform:xwiki-platform-administration-ui,org.apache.streampark:streampark,org.apache.dubbo:dubbo,org.xwiki.platform:xwiki-platform-search-ui). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 6
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- Remote code execution/programming rights with configuration section from any user account CVE-2023-50723 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-administration-ui>= 2.3, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-administration-ui>= 15.0-rc-1, < 15.5.2 → fixed in 15.5.2;org.xwiki.platform:xwiki-platform-administration-ui>= 15.6-rc-1, < 15.7-rc-1 → fixed in 15.7-rc-1 - Apache StreamPark: Authenticated system users could trigger remote command execution CVE-2023-49898
org.apache.streampark:streampark>= 2.0.0, < 2.1.2 → fixed in 2.1.2 - XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass CVE-2023-50722 CVSS 9.6 Critical
org.xwiki.platform:xwiki-platform-administration-ui>= 2.3, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-administration-ui>= 15.0-rc-1, < 15.5.2 → fixed in 15.5.2;org.xwiki.platform:xwiki-platform-administration-ui>= 15.6-rc-1, < 15.7-rc-1 → fixed in 15.7-rc-1 - Apache Dubbo: Bypass deny serialize list check in Apache Dubbo CVE-2023-46279 CVSS 9.8 Critical
org.apache.dubbo:dubbo= 3.1.5 → fixed in 3.1.6 - Remote code execution from account through SearchAdmin CVE-2023-50721 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-search-ui>= 4.5-rc-1, < 14.10.15 → fixed in 14.10.15;org.xwiki.platform:xwiki-platform-search-ui>= 15.0-rc-1, < 15.5.2 → fixed in 15.5.2;org.xwiki.platform:xwiki-platform-search-ui>= 15.6-rc-1, < 15.7-rc-1 → fixed in 15.7-rc-1 - Bypass serialize checks in Apache Dubbo CVE-2023-29234 CVSS 9.8 Critical
org.apache.dubbo:dubbo>= 3.1.0, < 3.1.11 → fixed in 3.1.11;org.apache.dubbo:dubbo>= 3.2.0, < 3.2.5 → fixed in 3.2.5