What CVEs Are and How They Help Track Security Vulnerabilities
Summary
The article explains how CVE identifiers catalog publicly disclosed vulnerabilities and describes their use in tracking and research, with examples involving MOVEit, Confluence and FortiOS vulnerabilities.
Key points
- CVE stands for Common Vulnerabilities and Exposures; each cataloged vulnerability receives a unique identifier used in advisories and vulnerability databases.
- The article says the first public CVE list appeared in 1999 and that more than 247,000 CVEs existed at the time of publication.
- It describes Cl0p's exploitation of MOVEit CVE-2023-34362 and cites estimates of roughly 2,000 exploited instances and about 60 million people affected.
- The article says the Ukrainian Cyber Alliance used Confluence CVE-2023-22515 to access Trigona's server and publish information about the group's infrastructure.
- It reports that Chinese actors exploited FortiOS CVE-2022-42475 to deploy the COATHANGER backdoor and access a network used by the Dutch military.
- The article describes DarkOwl Vision features for searching indexed material by CVE and filtering actor profiles by CVE.
Article Details
- Topic
- An introduction to CVEs, their role in vulnerability tracking, and examples of exploitation and research
CVE
CVE-2019-1306on the darknet by the user known by the moniker, PresidentXS, that discusses an Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability.” An attackerCVE-2022-30190Figure 2 shows a forum discussion about an exploit for CVE-2022-30190, which is a Microsoft office vulnerability that hackers can leverage for remote code execution.CVE-2022-42475CVE-2022-42475: FortiOS SSL-VPN VulnerabilityCVE-2023-22515CVE-2023-22515: Confluence Data Center and Server by AtlassianCVE-2023-34362CVE-2023-34362: MOVEit Transfer
People
Threat Actors
Malware
Vendors
AtlassianCVE-2023-22515: Confluence Data Center and Server by AtlassianFortinetContinuing their world-wide efforts to infiltrate government, military, and key sources of intel, China exploited an extant Fortinet vulnerability (CVE-2022-42475) in early February of this year.MicrosoftFigure 2 shows a forum discussion about an exploit for CVE-2022-30190, which is a Microsoft office vulnerability that hackers can leverage for remote code execution.
Products
Azure DevOpsby the user known by the moniker, PresidentXS, that discusses an Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability.” An attacker successfully exploitingConfluence Data Center and ServerCVE-2023-22515: Confluence Data Center and Server by AtlassianDarkOwl VisionCVEs in DarkOwl VisionFortiOSCVE-2022-42475: FortiOS SSL-VPN VulnerabilityMicrosoft OfficeFigure 2 shows a forum discussion about an exploit for CVE-2022-30190, which is a Microsoft office vulnerability that hackers can leverage for remote code execution.Progress MOVEit TransferThey exploited the SQL injection vulnerability known as CVE-2023-34362 in the MOVEit transfer system, which is extensively utilized for managing file transfer operations across numerous organizations.Team Foundation Serverthe moniker, PresidentXS, that discusses an Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability.” An attacker successfully exploiting this vulnerability
Tools
Countries
Industries
GovernmentContinuing their world-wide efforts to infiltrate government, military, and key sources of intel, China exploited an extant Fortinet vulnerability (CVE-2022-42475) in early February of this year.MilitaryContinuing their world-wide efforts to infiltrate government, military, and key sources of intel, China exploited an extant Fortinet vulnerability (CVE-2022-42475) in early February of this year.