Advisory No: TZCERT/SA/2024/07/26-6

Date of First Release: 26^th July 2024

Source: Spring

Software Affected: Spring Cloud Data Flow

Overview:

Spring is vulnerable to a remote code vulnerability. The attackers can leverage the vulnerability to compromise the server.

Description:

Spring Cloud Data Flow, a microservices-based streaming in Cloud Foundry and Kubernetes is affected by a vulnerability tracked as CVE-2024-37084. The vulnerability is a result of improper sanitization for the upload path, that a malicious user who has access to the Skipper server API can use a crafted upload request to write an arbitrary file to any location on the file system. The attackers can exploit the vulnerability to compromise the server by executing remote arbitrary codes.

Impact:

Successful exploitation of this vulnerability may allow an attacker to take control of the affected system.

Solution:

Spring has released a security patch for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References:

1. https://spring.io/security/cve-2024-37084
2. https://github.com/advisories/GHSA-p528-3mvf-gr87

Advisory No: TZCERT/SA/2024/07/26-5

Date of First Release: 26^th July 2024

Source: Dell

Software Affected: Dell EMC, Dell Protection Advisor, Dell VxRail, Dell RecoverPoint

Overview:

Dell products are vulnerable to multiple critical vulnerabilities. Exploitation of these vulnerabilities may allow attackers to execute arbitrary code on affected devices.

Description:

Multiple third-party components running on Dell EMC Avamar, Dell Protection Advisor, and Dell VxRail, Dell RecoverPoint are vulnerable to critical vulnerabilities. The vulnerabilities in these components may be exploited by the attackers to compromise the affected system.

Impact:

Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.

Solution:

Dell has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.

References:

1. https://www.dell.com/support/kbdoc/en-us/000180921/dsa-2020-266-dell-emc-avamar-security-update-for-multiple-components
2. https://www.dell.com/support/kbdoc/en-us/000227136/dsa-2024-053-security-update-for-data-protection-advisor-multiple-third-party-component-vulnerabilities
3. https://www.dell.com/support/kbdoc/en-us/000226716/dsa-2024-288-security-update-for-dell-vxrail-7-0-521-multiple-third-party-component-vulnerabilities
4. https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities

Advisory No: TZCERT/SA/2024/07/26-4

Date of First Release: 26^th July 2024

Source: D-Link

Software Affected: DIR-823X – Firmware v240126

Overview:

The firmware version in the D-Link device is vulnerable to a remote command execution vulnerability. The attackers can leverage the vulnerability to take control of the affected device.

Description:

DIR-823X Hardware Revision Ax, Firmware version 240126 is affected by a LAN-Side authenticated remote command execution vulnerability resulting from improper handling of the ntp_zone_val field in the CGI request for /goform/set_ntp by the web server. craft a malicious ntp_zone_val field and send a malicious HTTP request to the /goform/set_ntp CGI, leading to command execution with administrator privileges on the firmware file system.

Impact:

Successful exploitation of this vulnerability may allow an attacker to take control of the affected device.

Solution:

D-Link has released a hotfix for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References:

1. https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10404

Advisory No: TZCERT/SA/2024/07/26-3

Date of First Release: 26^th July 2024

Source: Wordfence

Software Affected: woo-social-login

Overview:

WordPress is vulnerable to a critical vulnerability. Exploitation of this vulnerability makes it possible for unauthenticated privilege escalation.

Description:

WordPress plugin woo-social-login is affected by the vulnerability tracked as CVE-2024-6636 with CVSS score of 9.8. The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the ‘woo_slg_login_email’ function. The attackers can exploit the vulnerability to change the default role to Administrator while registering for an account.

Impact:

Successful exploitation of this vulnerability may allow an attacker to gain unauthorized administrative access to the WordPress site.

Solution:

WordPress has released a security patch for this vulnerability. Users and administrators are encouraged to apply necessary updates.

References:

1. https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woo-social-login/woocommerce-social-login-273-missing-authorization-to-unauthenticated-privilege-escalation
2. https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883

Advisory No: TZCERT/SA/2024/07/26-2

Date of First Release: 26^th July 2024

Source: IBM

Software Affected:  Apache Velocity, protobuf.js, Containerd

Overview:

Multiple IBM products depending on Apache Velocity, protobuf.js, Containerd are vulnerable to critical vulnerabilities. Attackers can exploit the vulnerabilities to execute arbitrary code on the affected system.

Description:

Multiple IBM products depending on Apache Velocity, protobuf.js, and Containerd and are affected by critical vulnerabilities with CVSS base scores of 9.8 and tracked as CVE-2020-13936, CVE-2023-36665, and CVE-2020-15257 respectively. The vulnerabilities exist due to a sandbox bypass flaw in Apache Velocity, prototype pollution in protobufjs, and improper access control in containerd-shim API in containerd. The attackers can send specially-crafted requests to execute arbitrary code on the vulnerable system.

Impact:

Successful exploitation of these vulnerabilities may allow the attacker to take control of the affected system.

Solution:

IBM has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.

References:

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/197993
2. https://exchange.xforce.ibmcloud.com/vulnerabilities/259737
3. https://exchange.xforce.ibmcloud.com/vulnerabilities/192452