The US Cybersecurity and Infrastructure Security Agency (CISA) has added nine new flaws to its collection of actively exploited vulnerabilities, including two recently patched zero-days impacting Google Chrome and Adobe Commerce/Magento Open Source.
The Chrome vulnerability (CVE-2022-0609) is a high severity use after free bug that can let attackers execute arbitrary code or escape the browser’s security sandbox on computers running unpatched Chrome versions addressed in Chrome 98.0.4758.102.
Adobe released an emergency update to fix a critical flaw (CVE-2022-24086) exploited in the wild “in very limited attacks” to gain remote code execution using exploits targeting Adobe Commerce and Magento Open Source versions 2.4.3-p1/2.3.7-p2.
eCommerce security company Sansec warned that the Magento flaw is similar to the 2015 critical bug Magento Shoplift which enabled threat actors to take over vulnerable Magento sites.
CISA said that all Federal Civilian Executive Branch Agencies (FCEB) agencies must deploy patches for these two security vulnerabilities until March 1st, 2022.
The complete list of nine flaws added today to CISA’s Known Exploited Vulnerabilities Catalog includes a mix of old and new bugs, ranging from 2013 to 2022, as shown in the table below.
CVE Number
CVE Title
Patch Deadline
CVE-2022-24086
Adobe Commerce and Magento Open Source Improper Input Validation
03/01/22
CVE-2022-0609
Google Chrome Use-After-Free
03/01/22
CVE-2019-0752
Microsoft Internet Explorer Type Confusion
08/15/22
CVE-2018-8174
Microsoft Windows VBScript Engine Out-of-Bounds Write
08/15/22
CVE-2018-20250
WinRAR Absolute Path Traversal
08/15/22
CVE-2018-15982
Adobe Flash Player Use-After-Free
08/15/22
CVE-2017-9841
PHPUnit Command Injection
08/15/22
CVE-2014-1761
Microsoft Word Memory Corruption
08/15/22
CVE-2013-3906
Microsoft Graphics Component Memory Corruption
08/15/22
Federal agencies are required to patch their systems against these actively exploited vulnerabilities, according to a binding operational directive (BOD 22-01) issued by CISA in November 2021.
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise,” the cybersecurity agency said.
“Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”
