CVE Database: A Great Tool For Communicating Vulnerabilities To Organizations

In 1999, a non-profit company called MITRE was sponsored by the U.S. government to create a “Free Dictionary” to identify and catalog vulnerabilities in software and firmware. The idea behind the dictionary is to standardize and find known vulnerabilities and exposures. Going forward with that knowledge the hope is that countless organizations will discover their own systems vulnerabilities and fix or patch them before it’s too late.

CVE (Common Vulnerabilities and Exposures) built off MITRE’s work, and continues to expand its findings. CVE is sponsored by US-CERT within the Department of Homeland Security and the Office of Cybersecurity and Information Assurance. Armed with this CVE catalog of shared information and updates, businesses have a roadmap of what to look for and how to fix it. With this list, there’s no reason for enterprises not to be aware of threats and patch them as quickly as possible.

Earlier in 2019, WhiteHat Security compiled a list of the top 10 most common application security vulnerabilities in 2018.

1. jQuery File Upload RCE. CVE-2018-9206. This can allow an attacker to run commands on the affected servers. This issue goes back to 2015. All versions prior to 9.22.1 are vulnerable.
2. Magecart. This is not technically a CVE, and therefore no CVE number is assigned. However, this is a card skimming attack that has hit many organizations, including British Airways, Ticketmaster, and Newegg. It allows attackers to steal payment card information. It’s serious and active enough that the authors felt it important to include in this list.
3. WordPress DOS. CVE-2018-6989. This allows unauthenticated users to request massive numbers of files that leads to a Denial of Service (DoS) attack.
4. Drupalgeddon 2. CVE-2018-7600. Over 100,000 Drupal websites were estimated to be vulnerable to this. It is a remote code execution vulnerability. Users should update to Drupal version 7 or 8.
5. Drupalgeddon 3. CVE-2018-7602. As if one Drupalgeddon in a year wasn’t enough, there’s another one and it was also serious enough to make the list. This one was an extension of Drupalgeddon 2. It was exploiting the same issue, just in a different way. Upgrading to version 7 or 8 is recommended.
6. Telerisk’s RadAsyncUpload. Again, not technical a CVE, but serious enough to include. RadAsyncUpload uses a hard-coded key. If it isn’t changed, attackers can decrypt data and modify configurations. WhiteHat recommends setting strong custom encryption keys.
7. Spring Data Commons. CVE-2018-1273. In older unsupported versions of this, an attacker could execute remote code by exploiting the MapDataBinder class. It’s recommended to upgrade to at least 1.13 or higher.
8. Cross Site Scripting. CVE-2018-1999024. This may allow malicious JavaScript to be executed in the victim’s browser, if it’s exploited. It should be upgraded to version 2.7.4 or newer.
9. Flash Player Hack. CVE-2018-4878. There is a Flash Player issue about once a month. This one was exploited significantly in January and February of 2018 that could allow arbitrary code execution. However, it’s recommended that you just don’t allow Flash anymore. It will be unsupported soon and there are other options that don’t pose nearly the risk.
10. Spring OAuth Approval. CVE-2018-1260. This is vulnerable to remote code execution. Again, an upgrade to a version newer than 2.3.3 is recommended.

Remember that keeping systems updated with current patches and versions is a critical step to keeping your organization safe from these and other serious exploits and attacks.