---
title: "Security digest: May 23, 2024"
url: https://erroneo.us/security/2024-05-23/
description: "May 23, 2024 vulnerability digest: 1 CISA KEV addition (Apache); 1 critical advisory (Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-05-23
date_modified: 2024-05-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 23, 2024

1 known exploited (cisa kev) addition and 1 critical advisory.

## Take stock

- Do you run any of these? Apache Flink. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-06-13.
- Composer (PHP): 1 critical advisory ( silverstripe/framework ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2020-17519](https://erroneo.us/security/cve/CVE-2020-17519/index.md) Apache Flink: Apache Flink Improper Access Control Vulnerability (CISA due 2024-06-13)

## Critical advisories

- [GHSA-8v6m-7f5v-hhx6](https://erroneo.us/security/ghsa/GHSA-8v6m-7f5v-hhx6/index.md) Silverstripe Brute force bypass on default admin — Composer (PHP) silverstripe/framework >= 3.1.18, < 3.1.19 → 3.1.19; Composer (PHP) silverstripe/framework >= 3.2.3, < 3.2.4 → 3.2.4; Composer (PHP) silverstripe/framework >= 3.3.1, < 3.3.2 → 3.3.2

---
Source page: https://erroneo.us/security/2024-05-23/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt