--- title: "Security digest: October 24, 2024" url: https://erroneo.us/security/2024-10-24/ description: "October 24, 2024 vulnerability digest: 2 CISA KEV additions (Cisco, Roundcube); 1 critical advisory (Maven). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-10-24 date_modified: 2024-10-24 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 24, 2024 2 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Do you run any of these? Roundcube Webmail, Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-11-14. - Maven: 1 critical advisory ( org.openrefine.dependencies:butterfly ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-37383](https://erroneo.us/security/cve/CVE-2024-37383/index.md) Roundcube Webmail: RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability (CISA due 2024-11-14) - [CVE-2024-20481](https://erroneo.us/security/cve/CVE-2024-20481/index.md) Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD): Cisco ASA and FTD Denial-of-Service Vulnerability (CISA due 2024-11-14) ## Critical advisories - [CVE-2024-47883](https://erroneo.us/security/cve/CVE-2024-47883/index.md) Butterfly has path/URL confusion in resource handling leading to multiple weaknesses — Maven org.openrefine.dependencies:butterfly < 1.2.6 → 1.2.6 --- Source page: https://erroneo.us/security/2024-10-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt