--- title: "Security digest: October 22, 2024" url: https://erroneo.us/security/2024-10-22/ description: "October 22, 2024 vulnerability digest: 1 CISA KEV addition (Microsoft); 2 critical advisories (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-10-22 date_modified: 2024-10-22 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 22, 2024 1 known exploited (cisa kev) addition and 2 critical advisories. ## Take stock - Do you run any of these? Microsoft SharePoint. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-11-12. - Maven: 2 critical advisories ( com.liferay.portal:release.portal.bom , com.liferay.portal:release.dxp.bom ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-38094](https://erroneo.us/security/cve/CVE-2024-38094/index.md) Microsoft SharePoint: Microsoft SharePoint Deserialization Vulnerability (CISA due 2024-11-12) ## Critical advisories - [CVE-2024-8980](https://erroneo.us/security/cve/CVE-2024-8980/index.md) Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console — Maven com.liferay.portal:release.portal.bom >= 7.0.0-a1, < 7.4.3.102-GA102 → 7.4.3.102-GA102; Maven com.liferay.portal:release.dxp.bom >= 2023.Q3.1, < 2023.Q3.5 → 2023.Q3.5; Maven com.liferay.portal:release.dxp.bom >= 7.0.0-GA, <= 7.0.10.fp102 → no fix - [CVE-2024-38002](https://erroneo.us/security/cve/CVE-2024-38002/index.md) Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions — Maven com.liferay.portal:release.portal.bom >= 7.3.2-ga3, < 7.4.3.112-ga112 → 7.4.3.112-ga112; Maven com.liferay.portal:release.dxp.bom >= 2023.Q4.0, < 2023.Q4.6 → 2023.Q4.6; Maven com.liferay.portal:release.dxp.bom >= 2023.Q3.1, < 2023.Q3.9 → 2023.Q3.9 --- Source page: https://erroneo.us/security/2024-10-22/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt