---
title: "Security digest: April 23, 2024"
url: https://erroneo.us/security/2024-04-23/
description: "April 23, 2024 vulnerability digest: 1 CISA KEV addition (Microsoft); 3 critical advisories (Composer (PHP), Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-04-23
date_modified: 2024-04-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 23, 2024

1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Do you run any of these? Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-05-14.
- Composer (PHP): 2 critical advisories ( zendframework/zendframework1 , zendframework/zend-db , zendframework/zendframework , drupal/core , drupal/drupal ). Check with composer audit .
- Maven: 1 critical advisory ( org.open-metadata:openmetadata-service ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2022-38028](https://erroneo.us/security/cve/CVE-2022-38028/index.md) Microsoft Windows: Microsoft Windows Print Spooler Privilege Escalation Vulnerability  (CISA due 2024-05-14)

## Critical advisories

- [CVE-2014-8089](https://erroneo.us/security/cve/CVE-2014-8089/index.md) Zend Framework SQL injection vulnerability — Composer (PHP) zendframework/zendframework1 >= 1.12.0, < 1.12.9 → 1.12.9; Composer (PHP) zendframework/zend-db >= 2.0.0, < 2.0.99 → 2.0.99; Composer (PHP) zendframework/zend-db >= 2.1.0, < 2.1.99 → 2.1.99
- [CVE-2024-28253](https://erroneo.us/security/cve/CVE-2024-28253/index.md) OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`) — Maven org.open-metadata:openmetadata-service < 1.3.1 → 1.3.1
- [CVE-2018-7602](https://erroneo.us/security/cve/CVE-2018-7602/index.md) Drupal Core Remote Code Execution Vulnerability — Composer (PHP) drupal/core >= 7.0, < 7.59 → 7.59; Composer (PHP) drupal/core >= 8.0, < 8.4.8 → 8.4.8; Composer (PHP) drupal/core >= 8.5, < 8.5.3 → 8.5.3

---
Source page: https://erroneo.us/security/2024-04-23/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt