--- title: "Security digest: August 19, 2024" url: https://erroneo.us/security/2024-08-19/ description: "August 19, 2024 vulnerability digest: 1 CISA KEV addition (Jenkins); 2 critical advisories (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-08-19 date_modified: 2024-08-19 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: August 19, 2024 1 known exploited (cisa kev) addition and 2 critical advisories. ## Take stock - Do you run any of these? Jenkins Jenkins Command Line Interface (CLI). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-09-09. - Maven: 2 critical advisories ( org.xwiki.platform:xwiki-platform-oldcore , org.xwiki.platform:xwiki-platform-web-templates ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-23897](https://erroneo.us/security/cve/CVE-2024-23897/index.md) Jenkins Jenkins Command Line Interface (CLI): Jenkins Command Line Interface (CLI) Path Traversal Vulnerability (CISA due 2024-09-09) ## Critical advisories - [CVE-2024-43400](https://erroneo.us/security/cve/CVE-2024-43400/index.md) XWiki Platform allows XSS through XClass name in string properties — Maven org.xwiki.platform:xwiki-platform-oldcore >= 1.1.2, < 14.10.21 → 14.10.21; Maven org.xwiki.platform:xwiki-platform-oldcore >= 15.0-rc-1, < 15.5.5 → 15.5.5; Maven org.xwiki.platform:xwiki-platform-oldcore >= 15.6-rc-1, < 15.10.6 → 15.10.6 - [CVE-2024-43401](https://erroneo.us/security/cve/CVE-2024-43401/index.md) In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them — Maven org.xwiki.platform:xwiki-platform-web-templates < 15.10-rc-1 → 15.10-rc-1 --- Source page: https://erroneo.us/security/2024-08-19/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt