CISA Adds 3 Actively Exploited Flaws To KEV Catalog, Including Critical PaperCut Bug

CISA Adds 3 Actively Exploited Flaws To KEV Catalog, Including Critical PaperCut Bug

On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities that had been actively exploited to its catalog of Known Exploited Vulnerabilities (KEV).

The three vulnerabilities are as follows –

• CVE-2023-28432 (CVSS score – 7.5) – MinIO Information Disclosure Vulnerability
• CVE-2023-27350 (CVSS score – 9.8) – PaperCut MF/NG Improper Access Control Vulnerability
• CVE-2023-2136 (CVSS score – TBD) – Google Chrome Skia Integer Overflow Vulnerability

“In a cluster deployment, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure,” MinIO maintainers said in an advisory published on March 21, 2023.

ALSO, READ Hackers Actively Exploiting Citrix ADC and Gateway Zero-Day Vulnerability

From the United States, the Netherlands, France, Japan, and Finland, GreyNoise has identified as many as 18 separate malicious IP addresses attempting to exploit the weakness during the previous 30 days.

CISA Adds 3 Actively Exploited Flaws To KEV Catalog, Including Critical PaperCut Bug

The threat intelligence company, in an alert published late last month, also noted how a reference implementation provided by OpenAI for developers to integrate their plugins to ChatGPT relied on an older version of MinIO that’s vulnerable to CVE-2023-28432.

“While the new feature released by OpenAI is a valuable tool for developers who want to access live data from various providers in their ChatGPT integration, security should remain a core design principle,” GreyNoise’s Matthew Remacle said.

ALSO, READ Hack The Pentagon Site Promotes The Importance Of Bug Bounties To US Military

Also added to the KEV catalog is a critical remote code execution bug affecting PaperCut print management software that allows remote attackers to bypass authentication and run arbitrary code.

The vulnerability has been addressed by the vendor as of March 8, 2023, with the release of PaperCut MF and PaperCut NG versions 20.1.7, 21.2.11, and 22.0.9.

ALSO, READ Critical Flaws In vm2 JavaScript Library Can Lead to Remote Code Execution

Zero Day Initiative, which reported the issue on January 10, 2023, is expected to release additional technical details on May 10, 2023.

According to an update shared by the Melbourne-based company earlier this week, evidence of active exploitation of unpatched servers emerged in the wild around April 18, 2023.

CISA Adds 3 Actively Exploited Flaws To KEV Catalog, Including Critical PaperCut Bug

Cybersecurity firm Arctic Wolf said it “has observed intrusion activity associated with a vulnerable PaperCut Server where the RMM tool Synchro MSP was loaded onto a victim system.”

ALSO, READ New Actively Exploited Zero-Day Vulnerability Discovered in Apple Products

Lastly added to the list of actively exploited flaws is a Google Chrome vulnerability affecting the Skia 2D graphics library that could enable a threat actor to perform a sandbox escape via a crafted HTML page.

Federal Civilian Executive Branch (FCEB) agencies in the U.S. are recommended to remediate identified vulnerabilities by May 12, 2023, to secure their networks against active threats.