Pierluigi Paganini
February 26, 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SonicWall SonicOS and Palo Alto PAN-OS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
The two vulnerabilities are:
The first vulnerability, CVE-2023-34192 (CVSS score: 9.0), is a cross-site scripting (XSS) issue in Synacor ZCS. A remote authenticated attacker could exploit the vulnerability to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. The vulnerability was addressed in July 2023 with version 8.8.15 Patch 40.
The second vulnerability, CVE-2024-49035 (CVSS score: 8.7), is an improper access control vulnerability in Microsoft Partner Center, an attacker could exploit the flaw to escalate privileges. Microsoft addressed the vulnerability with the release of Patch Tuesday security updates in November 2024.
“An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.” reads the advisory published by Microsoft.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
CISA orders federal agencies to fix this vulnerability by March 25, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
