Alerts: CISA Adds One Known Exploited Vulnerability to Catalog

Jan 23, 2025

—

Source URL: https://www.cisa.gov/news-events/alerts/2025/01/23/cisa-adds-one-known-exploited-vulnerability-catalog
Source: Alerts
Title: CISA Adds One Known Exploited Vulnerability to Catalog

Feedly Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CVE-2020-11023 JQuery Cross-Site Scripting (XSS) Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

AI Summary and Description: Yes

Summary: The text highlights a new vulnerability added to CISA’s Known Exploited Vulnerabilities Catalog, specifically a JQuery Cross-Site Scripting (XSS) vulnerability. It emphasizes the significant risks posed by such vulnerabilities and outlines the obligations of federal agencies under Binding Operational Directive 22-01 to remediate these vulnerabilities, along with a strong recommendation for all organizations to enhance their vulnerability management practices.

Detailed Description:
The content focuses on the cybersecurity landscape, particularly concerning the Federal Civilian Executive Branch (FCEB) agencies in the United States, and presents critical insights into vulnerability management and compliance.

– **CVE-2020-11023**: The newly identified vulnerability pertains to JQuery and is categorized as a Cross-Site Scripting (XSS) flaw. This type of vulnerability is notably attractive to cybercriminals as it can be exploited to execute scripts in the context of a user’s browser session.

– **Active Exploitation Risks**: The text underscores that such vulnerabilities are frequently exploited by malicious actors, highlighting the urgency for organizations to address them swiftly to mitigate risks.

– **Binding Operational Directive 22-01**: This directive plays a critical role in cybersecurity policy for federal agencies:
– Establishes the Known Exploited Vulnerabilities Catalog, a continuously updated list of impactful CVEs.
– Mandates FCEB agencies to remediate listed vulnerabilities promptly, ensuring the protection of their networks from active threats.

– **CISA’s Recommendations**: While BOD 22-01 specifically targets federal agencies, CISA advocates for all organizations to adopt proactive vulnerability management practices:
– Timely remediation of cataloged vulnerabilities is encouraged to minimize exposure to cyberattacks.
– Organizations of all types are urged to prioritize identified vulnerabilities.

– **Future Additions**: CISA monitors and evaluates vulnerabilities continuously, suggesting that the catalog will be expanded with further vulnerabilities that meet specific criteria, indicating a dynamic threat landscape.

Overall, the text serves as a crucial reminder of the ongoing cybersecurity risks present in software applications and reinforces the need for robust vulnerability management approaches across all sectors, especially amidst an era of increasing cyber threats. Security and compliance professionals need to take note of such directives and integrate them into their organizational frameworks to enhance security postures effectively.

01 1 2 3 5 a Act active exploitation active threats AI alerts and Application applications art as attack attack vectors attacks based Binding Operational Directive Binding Operational Directive 22 browser by C catalog CIA CISA Common Vulnerabilities Common Vulnerabilities and Exposures compliance compliance professionals content Context core critical cross cross-site scripting cross-site scripting (XSS) CVE cyber cyber actors cyber threat cyber threats cyberattack Cyberattacks cybercriminal cybercriminals Cybersecurity cybersecurity landscape cybersecurity policy Cybersecurity Risks D de directive e effective end enterprise ERP event exp exploit Exploitation exploitation risk exploitation risks exploited vulnerabilities Exposures fact federal agencies Federal Civilian Executive Branch federal enterprise for framework frameworks future g Gen Go high Highlight HR http HTTPS in information insights ite jq k Known Exploited Vulnerabilities Known Exploited Vulnerabilities Catalog l land law led Living long malicious actors malicious cyber actors management media mini Monitor network networks news no o of on one operation opt organization organizations out over policy post pre proactive proactive vulnerability management professionals prompt R rag rate RCE red remediation Risk risks Ro Role s sec security security and compliance security landscape security posture security postures security risk security risks Sig site scripting software software applications source state Swift T text the threat threat landscape threats Time to Tor TP two UI United States up update US use user V val vectors vulnerabilities vulnerabilities catalog vulnerability Vulnerability Management vulnerability management practice Wi x XSS