CCTR.12.March.24
MFT, Cybers, Audit committees and more vulnerabilities
Last updated
MFT, Cybers, Audit committees and more vulnerabilities
Last updated
Audit committees have identified cybersecurity as their top oversight priority, particularly as the Securities and Exchange Commission enforces stringent rules on cyberattack disclosure. Within audit committee members, 69% view cybersecurity as a paramount concern, with 30% ranking it as their primary risk priority. Ref LRQA Nettitude discovered a critical vulnerability, CVE-2024-25153, in Fortra FileCatalyst, impacting versions prior to 5.1.6 Build 114. This vulnerability enables remote unauthenticated attackers to gain full control of the managed file transfer (MFT) web server. This holds significant implications within the realm of MFT applications. In 2023, actors exploited vulnerabilities in MOVEit Transfer MFT and Fortra GoAnywhere MFT on a mass scale to compromise thousands of organisations globally. Ref Fortinet has released a critical patch for a high-risk vulnerability, CVE-2024-48788 (CVSS 9.3), in its FortiClient Enterprise Management Server (EMS), allowing attackers to execute commands with system admin privileges. Immediate patching is advised. There has been a persistent trend of attacks targeting Fortinet devices, with recent vulnerabilities exploited in ransomware attacks and cyber espionage campaigns. Ref Horizon3.ai has published technical details and a proof-of-concept (PoC) exploit for a critical authentication bypass vulnerability, CVE-2024-1403 (CVSS 10), impacting Progress Software's OpenEdge versions and 12.8.0 and earlier. Ref Akamai Technologies discovered a notable vulnerability in Kubernetes tracked as CVE-2023-5528 (CVSS 7.2). This vulnerability affects default installations of Kubernetes before version 1.28.4 and poses a significant risk of complete takeover of all Windows nodes in a cluster. The discovery of vulnerabilities like this highlights the importance of the shared responsibility model in cloud security, emphasizing the need for proactive measures to mitigate risks. Ref
