Skip to main content

Fix now: High risk vulnerabilities at large, August 2020

Fix now: High risk vulnerabilities at large, August 2020

12.Aug.2020
Simon Roe, Product Manager Outpost24
Since April 2020 we’ve been writing about the latest CVEs to look out for in our risk based vulnerability management blog. Going into August we are highlighting a CVE affecting a popular password vault – KeePass, along with a few interesting ones. Read on for more information on how to prioritize these vulnerabilities for patching to mitigate risk.
High risk vulnerabilities

Cisco Input validation vulnerability

CVE Description CVSSv3 Score Farsight Rating Last seen (Farsight)
CVE-2020-3452 Input validation in the web services interface 7.5 38.46 2020-07-30

This vulnerability affects the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defence (FTD) Software and could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. At the time of writing, several exploits have been released into the wild resulting in the highest likelihood risk score of 38.46. We strongly urge customers and readers of this blog to patch their affected systems as soon as possible, information on the affected platforms and the patch can be found here.

Kubernetes Vulnerability

CVE Description CVSSv3 Score Farsight Rating Last seen (Farsight)
CVE-2020-8558 Security issue allowing adjacent hosts to access TCP and UDP services running on 127.0.0.1 8.8 7.97 2020-07-29
CVE-2020-8559 Specific version of the kube-apiserver are vulnerable to an unvalidated redirect leading to privilege escalation 6.8 13.17 2020-07-30

The first vulnerability allows a threat actor to reach kube-proxy from the LAN even if it is configured to listen to a local host. The second vulnerability allows for privilege escalation from a compromised node to a cluster. That means that non authenticated services or clusters that share the same certificates can be easily compromised and the supposed network boundaries do not apply. Apart from the usual patch remediation we recommend that you use authentication and do not share credentials or certificates. More information can be found here (8558) and here (8559).

Wordpress SeedProd Coming soon XSS

CVE Description CVSSv3 Score Farsight Rating Last seen (Farsight)
CVE-2020-15038 SeedProd XSS vulnerability 5.4 38.46 2020-07-26

A medium risk (CVSSv3) vulnerability affecting the Seedprod plugin which is used by over 1,000,000 websites globally that can result in a successful cross site scripting attack.

There are multiple ways this vulnerability could be exploited, such as a redirection or phishing attacks. This could, in both cases, result in the user of the site being tricked into submitting their credentials to the fake website. With several in the wild exploits and such a large deployment footprint this medium CVSS vulnerability rightly has the highest likelihood risk score.

We therefore recommend our customers and blog readers to look at their WordPress sites and if they are using this plugin, patch as soon as possible. Information can be found here.

KeePass RPC vulnerability

CVE Description CVSSv3 Score Farsight Rating Last seen (Farsight)
Cve-2020-16271 The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection N/A 7.97 2020-08-03
CVE-2020-16272 The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter N/A 7.97 2020-08-03

KeePass is a popular password vault, in use by private citizens and organizations alike. This vulnerability makes it possible for a threat actor to access passwords stored in the vault with little or no trace evidence. However, at the time of writing there were no known publicly available exploits. The fix and more information can be found here.

Both vulnerabilities, at the time of writing, were awaiting their respective CVSSv3 score.

Wrap up

This week we have a mixed bag of vulnerabilities affecting a number of popular software packages as well as Cisco hardware. As always, it’s important for organizations to keep up with remediation activities across all of their software and hardware stacks. For those of you who might be using KeePass at home, make sure you apply the update there as well.

SUBSCRIBE TO OUR EMAIL

Looking for anything in particular?

Type your search word here