CISA includes ancient Apache Flink bug in KEV collection. | CybSec Wizard

Cyber Security Wizard

Wizardry for Cyber

Cyber Security Wizard

TLDR:

Ongoing attacks exploiting an access control flaw in Apache Flink have prompted CISA to add the bug to its KEV catalog. Federal agencies are urged to remediate the bug by June 13.

Key points:

Improper access control flaw in Apache Flink (CVE-2020-17519) added to CISA’s KEV catalog
Attacks leverage the flaw in Flink versions 1.11.0, 1.11.1, and 1.11.2, allowing unauthorized data access

Recent attacks using an improper access control flaw in Apache Flink have led to the bug being added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. The flaw, known as CVE-2020-17519, affects versions 1.11.0, 1.11.1, and 1.11.2 of Apache Flink and allows intrusions that could facilitate unauthorized data access through directory traversal requests.

No specific details about the attacks exploiting the flaw have been provided, but threat actors were previously reported by Palo Alto Networks Unit 42 to have been heavily leveraging the bug from November 2020 to January 2021. Unit 42 researchers highlighted the emergence of newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, which were continuously being exploited in the wild during late 2020 to early 2021.

Federal agencies have been urged to remediate the bug by June 13 to mitigate the risk of further intrusions leveraging this vulnerability. The addition of this years-old Apache Flink bug to the KEV catalog underscores the ongoing importance of addressing known vulnerabilities to enhance overall cybersecurity posture.

Post Views: 93

Adrian Johnson

Latest from Blog

Moody’s: Cyber insurance competition rises, prices fall

Moody’s Ratings: Cyber Insurance Competition Up, Prices Down TLDR: Cyber insurance market poised for growth due to increased demand. New players entering the market may decrease premiums. Article Summary The cyber insurance

Syxsense acquires Absolute to beat cyber vulnerabilities with strength

TLDR: Absolute Security has acquired Syxsense to enhance its cyber resilience platform. The acquisition will simplify patching and remediation issues through automation. Article Summary: Absolute Security has acquired Syxsense to improve its

Apache’s OFBiz gets new fix for RCE exploits

TLDR: Apache released a security update for OFBiz to patch vulnerabilities, including a bypass of patches for two exploited flaws. The bypass, tracked as CVE-2024-45195, allows unauthenticated remote attackers to execute code

Feds caution: Russia-linked CVE threats target essential infrastructure

TLDR: Threat groups linked to Russia’s military intelligence service are targeting critical infrastructure in various sectors. The attackers have defaced websites, scanned infrastructure, and leaked stolen data. Summary: Federal authorities in the

Allies blame Russian military for destructive cyber-attacks

TLDR: US and allies accuse Russian military of launching cyber-attacks targeting critical infrastructure for espionage and sabotage purposes. Unit 29155, a cyber group affiliated with the Russian military, is responsible for deploying

Brazil bans X, and Tom Alcock on cybersecurity talent hunt

TLDR: Key Points: Brazil banned X (Twitter) due to misinformation during the presidential election. Tom Alcock, founder of Code Red Partners, discussed the importance of cybersecurity talent recruitment beyond traditional methods. In

Palo Alto Networks acquires IBM’s QRadar Assets in SIEM victory

Article Summary TLDR: Palo Alto Networks has acquired IBM’s QRadar SaaS assets to enhance its cybersecurity capabilities. The integration of QRadar’s assets into Palo Alto Networks’ Cortex XSIAM platform will lead to

NIST CSF 20: Secure your cyber world with confidence framework

TLDR: NIST has released Version 2.0 of its Cybersecurity Framework (CSF) with an enhanced focus on Privileged Access Management (PAM) and Identity & Access Management (IAM). Key updates in NIST CSF 2.0

NSFOCUS launches digital shield for superior cyber defense capabilities

TLDR: NSFOCUS has introduced a Digital Risk Protection Service (DRPS) to protect against evolving threats like fraud and data breaches in the digital landscape. The service offers features such as monitoring for

Russian military hackers behind US attacks according to NSA Report

TLDR: A recent NSA report has attributed U.S. cyber attacks since 2020 to Russian military hackers. The hackers are affiliated with the Russian Unit 29155 and have targeted critical infrastructure globally. Summary: