CVE-2023-29306

🗓️ 13 Sep 2023 08:27:18Reported by adobeType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 57 Views

Adobe Connect versions prior to 12.3 reflected XSS vulnerabilit

Reporter	Title	Published	Views	Family All 13
Tenable Nessus	Adobe Connect <= 12.3.0 Multiple Arbitrary Code Execution Vulnerabilities (APSB23-33)	12 Sep 202300:00	–	nessus
Circl	CVE-2023-29306	13 Sep 202312:00	–	circl
CNNVD	Adobe Connect 跨站脚本漏洞	13 Sep 202300:00	–	cnnvd
CNVD	Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2023-82285)	18 Sep 202300:00	–	cnvd
Cvelist	CVE-2023-29306 Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code execution	13 Sep 202308:27	–	cvelist
EUVD	EUVD-2023-32881	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Adobe Connect	14 Sep 202300:00	–	ncsc
NVD	CVE-2023-29306	13 Sep 202309:15	–	nvd
OSV	CVE-2023-29306	13 Sep 202309:15	–	osv
Prion	Cross site scripting	13 Sep 202309:15	–	prion

NVD

Vulners

Node

adobe connectRange≤12.3

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Connect",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "12.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
helpx	www.helpx.adobe.com/security/products/connect/apsb23-33.html

**MS-ISACCYBERSECURITYADVISORY****MS-ISACADVISORYNUMBER:**2023-105**DATE(S)ISSUED:**09/12/2023**SUBJECT:**MultipleVulnerabilitiesinAdobeProductsCouldAllowforArbitraryCodeExecution**OVERVIEW:**MultiplevulnerabilitieshavebeendiscoveredinAdobeproducts,themostsevereofwhichcouldallowforarbitrarycodeexecution.*AdobeAcrobatisusedtoview,create,print,andmanagePDFfiles*AdobeReaderisusedtoview,create,print,andmanagePDFfiles*AdobeExperienceManagerisacomprehensivecontentmanagementsolutionforbuildingwebsites,mobileappsandforms*AdobeConnectisasuiteofsoftwareforremotetraining,webconferencing,presentation,anddesktopsharingSuccessfulexploitationofthemostsevereofthesevulnerabilitiescouldallowforarbitrarycodeexecutioninthecontextoftheloggedonuser.Dependingontheprivilegesassociatedwiththeuser,anattackercouldtheninstallprograms;view,change,ordeletedata;orcreatenewaccountswithfulluserrights.Userswhoseaccountsareconfiguredtohavefeweruserrightsonthesystemcouldbelessimpactedthanthosewhooperatewithadministrativeuserrights.**THREATINTELLIGENCE:**AdobeisawarethatCVE-2023-26369hasbeenexploitedinthewildinlimitedattackstargetingAdobeAcrobatandReader.**SYSTEMSAFFECTED:***AcrobatDCversions23.003.20284andearlier*AcrobatReaderDCversions23.003.20284andearlier*Acrobat2020versions20.005.30516(Mac)andearlier*Acrobat2020versions20.005.30514(Win)andearlier*AcrobatReader2020versions20.005.30516(Mac)andearlier*AcrobatReader2020versions20.005.30514(Win)andearlier*AdobeExperienceManager(AEM)AEMCloudService(CS)versions2023.8andearlier*AdobeExperienceManager(AEM)versions6.5.17.0andearlier*AdobeConnectversions12.3andearlier**RISK:****Government:***Largeandmediumgovernmententities:**High***Smallgovernmententities:**Medium****Businesses:***Largeandmediumbusinessentities:**High***Smallbusinessentities:**Medium****Homeusers:Low****TECHNICALSUMMARY:**MultiplevulnerabilitieshavebeendiscoveredinAdobeProducts,themostsevereofwhichcouldallowforarbitrarycodeexecution.Detailsofthesevulnerabilitiesareasfollows**Tactic**:*Execution***(**[TA0002](https://learn.cisecurity.org/e/799323/tactics-TA0002-/4t6f4x/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**)**:**Technique**:*ExploitationforClientExecution***(**[T1203](https://learn.cisecurity.org/e/799323/techniques-T1203-/4t6f51/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**):**AdobeAcrobatandReader:*Out-of-boundsWrite,whichcouldresultinArbitrarycodeexecution(CVE-2023-26369)AdobeExperienceManager:*Cross-siteScripting(ReflectedXSS),whichcouldresultinArbitrarycodeexecution(CVE-2023-38214andCVE-2023-38215)AdobeConnect:*Cross-siteScripting(ReflectedXSS),whichcouldresultinArbitrarycodeexecution(CVE-2023-29305andCVE-2023-29306)Successfulexploitationofthemostsevereofthesevulnerabilitiescouldallowforarbitrarycodeexecution.Dependingontheprivilegesassociatedwiththeuseranattackercouldtheninstallprograms;view,change,ordeletedata;orcreatenewaccountswithfulluserrights.Userswhoseaccountsareconfiguredtohavefeweruserrightsonthesystemcouldbelessimpactedthanthosewhooperatewithadministrativeuserrights.**RECOMMENDATIONS:**Werecommendthefollowingactionsbetaken:*ApplyappropriateupdatesprovidedbyAdobetovulnerablesystemsimmediatelyafterappropriatetesting.([**M1051**](https://learn.cisecurity.org/e/799323/mitigations-M1051-/4t6f54/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:UpdateSoftware**)***Safeguard7.1:EstablishandMaintainaVulnerabilityManagementProcess:**Establishandmaintainadocumentedvulnerabilitymanagementprocessforenterpriseassets.Reviewandupdatedocumentationannually,orwhensignificantenterprisechangesoccurthatcouldimpactthisSafeguard.***Safeguard7.2:EstablishandMaintainaRemediationProcess:**Establishandmaintainarisk-basedremediationstrategydocumentedinaremediationprocess,withmonthly,ormorefrequent,reviews.***Safeguard7.4:PerformAutomatedApplicationPatchManagement:**Performapplicationupdatesonenterpriseassetsthroughautomatedpatchmanagementonamonthly,ormorefrequent,basis.***Safeguard7.5:PerformAutomatedVulnerabilityScansofInternalEnterpriseAssets:**Performautomatedvulnerabilityscansofinternalenterpriseassetsonaquarterly,ormorefrequent,basis.Conductbothauthenticatedandunauthenticatedscans,usingaSCAP-compliantvulnerabilityscanningtool.***Safeguard7.7:RemediateDetectedVulnerabilities:**Remediatedetectedvulnerabilitiesinsoftwarethroughprocessesandtoolingonamonthly,ormorefrequent,basis,basedontheremediationprocess.***Safeguard12.1:EnsureNetworkInfrastructureisUp-to-Date:**Ensurenetworkinfrastructureiskeptup-to-date.Exampleimplementationsincluderunningthelateststablereleaseofsoftwareand/orusingcurrentlysupportednetwork-as-a-service(NaaS)offerings.Reviewsoftwareversionsmonthly,ormorefrequently,toverifysoftwaresupport.***Safeguard18.1:EstablishandMaintainaPenetrationTestingProgram:**Establishandmaintainapenetrationtestingprogramappropriatetothesize,complexity,andmaturityoftheenterprise.Penetrationtestingprogramcharacteristicsincludescope,suchasnetwork,webapplication,ApplicationProgrammingInterface(API),hostedservices,andphysicalpremisecontrols;frequency;limitations,suchasacceptablehours,andexcludedattacktypes;pointofcontactinformation;remediation,suchashowfindingswillberoutedinternally;andretrospectiverequirements.***Safeguard18.2:PerformPeriodicExternalPenetrationTests:**Performperiodicexternalpenetrationtestsbasedonprogramrequirements,nolessthanannually.Externalpenetrationtestingmustincludeenterpriseandenvironmentalreconnaissancetodetectexploitableinformation.Penetrationtestingrequiresspecializedskillsandexperienceandmustbeconductedthroughaqualifiedparty.Thetestingmaybeclearboxoropaquebox.***Safeguard18.3:RemediatePenetrationTestFindings:**Remediatepenetrationtestfindingsbasedontheenterprise’spolicyforremediationscopeandprioritization.*Vulnerabilityscanningisusedtofindpotentiallyexploitablesoftwarevulnerabilitiestoremediatethem.**(**[**M1016**](https://learn.cisecurity.org/e/799323/mitigations-M1016-/4t6f57/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:VulnerabilityScanning)*****Safeguard16.13:ConductApplicationPenetrationTesting:**Conductapplicationpenetrationtesting.Forcriticalapplications,authenticatedpenetrationtestingisbettersuitedtofindingbusinesslogicvulnerabilitiesthancodescanningandautomatedsecuritytesting.Penetrationtestingreliesontheskillofthetestertomanuallymanipulateanapplicationasanauthenticatedandunauthenticateduser.*ApplythePrincipleofLeastPrivilegetoallsystemsandservices.Runallsoftwareasanon-privilegeduser(onewithoutadministrativeprivileges)todiminishtheeffectsofasuccessfulattack.([**M1026**](https://learn.cisecurity.org/e/799323/mitigations-M1026-/4t6f5b/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:PrivilegedAccountManagement**)***Safeguard4.7:ManageDefaultAccountsonEnterpriseAssetsandSoftware:**Managedefaultaccountsonenterpriseassetsandsoftware,suchasroot,administrator,andotherpre-configuredvendoraccounts.Exampleimplementationscaninclude:disablingdefaultaccountsormakingthemunusable.***Safeguard5.4:RestrictAdministratorPrivilegestoDedicatedAdministratorAccounts:**Restrictadministratorprivilegestodedicatedadministratoraccountsonenterpriseassets.Conductgeneralcomputingactivities,suchasinternetbrowsing,email,andproductivitysuiteuse,fromtheuser’sprimary,non-privilegedaccount.***Safeguard5.5:EstablishandMaintainanInventoryofServiceAccounts:**Establishandmaintainaninventoryofserviceaccounts.Theinventory,ataminimum,mustcontaindepartmentowner,reviewdate,andpurpose.Performserviceaccountreviewstovalidatethatallactiveaccountsareauthorized,onarecurringscheduleataminimumquarterly,ormorefrequently*Architectsectionsofthenetworktoisolatecriticalsystems,functions,orresources.Usephysicalandlogicalsegmentationtopreventaccesstopotentiallysensitivesystemsandinformation.UseaDMZtocontainanyinternet-facingservicesthatshouldnotbeexposedfromtheinternalnetwork.Configureseparatevirtualprivatecloud(VPC)instancestoisolatecriticalcloudsystems.**(**[**M1030**](https://learn.cisecurity.org/e/799323/mitigations-M1030-/4t6f5f/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:NetworkSegmentation)*****Safeguard12.2:EstablishandMaintainaSecureNetworkArchitecture:**Establishandmaintainasecurenetworkarchitecture.Asecurenetworkarchitecturemustaddresssegmentation,leastprivilege,andavailability,ataminimum.*Usecapabilitiestodetectandblockconditionsthatmayleadtoorbeindicativeofasoftwareexploitoccurring.([**M1050**](https://learn.cisecurity.org/e/799323/mitigations-M1050-/4t6f5j/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:ExploitProtection**)***Safeguard10.5:****EnableAnti-ExploitationFeatures:**Enableanti-exploitationfeaturesonenterpriseassetsandsoftware,wherepossible,suchasMicrosoft®DataExecutionPrevention(DEP),Windows®DefenderExploitGuard(WDEG),orApple®SystemIntegrityProtection(SIP)andGatekeeper™.*Restrictuseofcertainwebsites,blockdownloads/attachments,blockJavascript,restrictbrowserextensions,etc.([**M1021**](https://learn.cisecurity.org/e/799323/mitigations-M1021-/4t6f5m/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:RestrictWeb-BasedContent**)***Safeguard9.2:UseDNSFilteringServices:**UseDNSfilteringservicesonallenterpriseassetstoblockaccesstoknownmaliciousdomains.***Safeguard9.3:MaintainandEnforceNetwork-BasedURLFilters:**Enforceandupdatenetwork-basedURLfilterstolimitanenterpriseassetfromconnectingtopotentiallymaliciousorunapprovedwebsites.Exampleimplementationsincludecategory-basedfiltering,reputation-basedfiltering,orthroughtheuseofblocklists.Enforcefiltersforallenterpriseassets.***Safeguard9.6:BlockUnnecessaryFileTypes:**Blockunnecessaryfiletypesattemptingtoentertheenterprise’semailgateway.*Remindusersnottovisitun-trustedwebsitesorfollowlinksprovidedbyunknownorun-trustedsources.Informandeducateusersregardingthethreatsposedbyhypertextlinkscontainedinemailsorattachmentsespeciallyfromun-trustedsources.([**M1017**](https://learn.cisecurity.org/e/799323/mitigations-M1017-/4t6f5q/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE)**:UserTraining**)***Safeguard14.1:EstablishandMaintainaSecurityAwarenessProgram:**Establishandmaintainasecurityawarenessprogram.Thepurposeofasecurityawarenessprogramistoeducatetheenterprise’sworkforceonhowtointeractwithenterpriseassetsanddatainasecuremanner.Conducttrainingathireand,ataminimum,annually.Reviewandupdatecontentannually,orwhensignificantenterprisechangesoccurthatcouldimpactthisSafeguard.***Safeguard14.2:TrainWorkforceMemberstoRecognizeSocialEngineeringAttacks:**Trainworkforcememberstorecognizesocialengineeringattacks,suchasphishing,pre-texting,andtailgating.**REFERENCES:**>**Adobe:**[https://helpx.adobe.com/security.html](https://helpx.adobe.com/security.html)[https://helpx.adobe.com/security/products/acrobat/apsb23-34.html](https://helpx.adobe.com/security/products/acrobat/apsb23-34.html)[https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html](https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html)[https://helpx.adobe.com/security/products/connect/apsb23-33.html](https://helpx.adobe.com/security/products/connect/apsb23-33.html)**CVE:**[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26369](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26369)[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29305)[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29306)[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38214)[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38215)MS-ISACCYBERSECURITYADVISORY-MultipleVulnerabilitiesinAdobeProductsCouldAllowforArbitraryCodeExecution-PATCH:NOW<divclass="md">MS-ISACCYBERSECURITYADVISORYMS-ISACADVISORYNUMBER: 2023-105DATE(S)ISSUED: 09/12/2023SUBJECT: MultipleVulnerabilitiesinAdobeProductsCouldAllowforArbitraryCodeExecutionOVERVIEW: MultiplevulnerabilitieshavebeendiscoveredinAdobeproducts,themostsevereofwhichcouldallowforarbitrarycodeexecution.<ul><li>AdobeAcrobatisusedtoview,create,print,andmanagePDFfiles</li><li>AdobeReaderisusedtoview,create,print,andmanagePDFfiles</li><li>AdobeExperienceManagerisacomprehensivecontentmanagementsolutionforbuildingwebsites,mobileappsandforms</li><li>AdobeConnectisasuiteofsoftwareforremotetraining,webconferencing,presentation,anddesktopsharing</li></ul>Successfulexploitationofthemostsevereofthesevulnerabilitiescouldallowforarbitrarycodeexecutioninthecontextoftheloggedonuser.Dependingontheprivilegesassociatedwiththeuser,anattackercouldtheninstallprograms;view,change,ordeletedata;orcreatenewaccountswithfulluserrights.Userswhoseaccountsareconfiguredtohavefeweruserrightsonthesystemcouldbelessimpactedthanthosewhooperatewithadministrativeuserrights.THREATINTELLIGENCE: AdobeisawarethatCVE-2023-26369hasbeenexploitedinthewildinlimitedattackstargetingAdobeAcrobatandReader.SYSTEMSAFFECTED:<ul><li>AcrobatDCversions23.003.20284andearlier</li><li>AcrobatReaderDCversions23.003.20284andearlier</li><li>Acrobat2020versions20.005.30516(Mac)andearlier</li><li>Acrobat2020versions20.005.30514(Win)andearlier</li><li>AcrobatReader2020versions20.005.30516(Mac)andearlier</li><li>AcrobatReader2020versions20.005.30514(Win)andearlier</li><li>AdobeExperienceManager(AEM)AEMCloudService(CS)versions2023.8andearlier</li><li>AdobeExperienceManager(AEM)versions6.5.17.0andearlier</li><li>AdobeConnectversions12.3andearlier</li></ul>RISK: Government:<ul><li>Largeandmediumgovernmententities:High</li><li>Smallgovernmententities:Medium</li></ul>Businesses:<ul><li>Largeandmediumbusinessentities:High</li><li>Smallbusinessentities:Medium</li></ul>Homeusers:LowTECHNICALSUMMARY: MultiplevulnerabilitieshavebeendiscoveredinAdobeProducts,themostsevereofwhichcouldallowforarbitrarycodeexecution.DetailsofthesevulnerabilitiesareasfollowsTactic:Execution(<ahref="https://learn.cisecurity.org/e/799323/tactics-TA0002-/4t6f4x/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">TA0002</a>):Technique:ExploitationforClientExecution(<ahref="https://learn.cisecurity.org/e/799323/techniques-T1203-/4t6f51/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">T1203</a>):AdobeAcrobatandReader:<ul><li>Out-of-boundsWrite,whichcouldresultinArbitrarycodeexecution(CVE-2023-26369)</li></ul>AdobeExperienceManager:<ul><li>Cross-siteScripting(ReflectedXSS),whichcouldresultinArbitrarycodeexecution(CVE-2023-38214andCVE-2023-38215)</li></ul>AdobeConnect:<ul><li>Cross-siteScripting(ReflectedXSS),whichcouldresultinArbitrarycodeexecution(CVE-2023-29305andCVE-2023-29306)</li></ul>Successfulexploitationofthemostsevereofthesevulnerabilitiescouldallowforarbitrarycodeexecution.Dependingontheprivilegesassociatedwiththeuseranattackercouldtheninstallprograms;view,change,ordeletedata;orcreatenewaccountswithfulluserrights.Userswhoseaccountsareconfiguredtohavefeweruserrightsonthesystemcouldbelessimpactedthanthosewhooperatewithadministrativeuserrights.RECOMMENDATIONS: Werecommendthefollowingactionsbetaken:<ul><li>ApplyappropriateupdatesprovidedbyAdobetovulnerablesystemsimmediatelyafterappropriatetesting.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1051-/4t6f54/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1051</a>:UpdateSoftware)<ul><li>Safeguard7.1:EstablishandMaintainaVulnerabilityManagementProcess:Establishandmaintainadocumentedvulnerabilitymanagementprocessforenterpriseassets.Reviewandupdatedocumentationannually,orwhensignificantenterprisechangesoccurthatcouldimpactthisSafeguard.</li><li>Safeguard7.2:EstablishandMaintainaRemediationProcess:Establishandmaintainarisk-basedremediationstrategydocumentedinaremediationprocess,withmonthly,ormorefrequent,reviews.</li><li>Safeguard7.4:PerformAutomatedApplicationPatchManagement:Performapplicationupdatesonenterpriseassetsthroughautomatedpatchmanagementonamonthly,ormorefrequent,basis.</li><li>Safeguard7.5:PerformAutomatedVulnerabilityScansofInternalEnterpriseAssets:Performautomatedvulnerabilityscansofinternalenterpriseassetsonaquarterly,ormorefrequent,basis.Conductbothauthenticatedandunauthenticatedscans,usingaSCAP-compliantvulnerabilityscanningtool.</li><li>Safeguard7.7:RemediateDetectedVulnerabilities:Remediatedetectedvulnerabilitiesinsoftwarethroughprocessesandtoolingonamonthly,ormorefrequent,basis,basedontheremediationprocess.</li><li>Safeguard12.1:EnsureNetworkInfrastructureisUp-to-Date:Ensurenetworkinfrastructureiskeptup-to-date.Exampleimplementationsincluderunningthelateststablereleaseofsoftwareand/orusingcurrentlysupportednetwork-as-a-service(NaaS)offerings.Reviewsoftwareversionsmonthly,ormorefrequently,toverifysoftwaresupport.</li><li>Safeguard18.1:EstablishandMaintainaPenetrationTestingProgram:Establishandmaintainapenetrationtestingprogramappropriatetothesize,complexity,andmaturityoftheenterprise.Penetrationtestingprogramcharacteristicsincludescope,suchasnetwork,webapplication,ApplicationProgrammingInterface(API),hostedservices,andphysicalpremisecontrols;frequency;limitations,suchasacceptablehours,andexcludedattacktypes;pointofcontactinformation;remediation,suchashowfindingswillberoutedinternally;andretrospectiverequirements.</li><li>Safeguard18.2:PerformPeriodicExternalPenetrationTests:Performperiodicexternalpenetrationtestsbasedonprogramrequirements,nolessthanannually.Externalpenetrationtestingmustincludeenterpriseandenvironmentalreconnaissancetodetectexploitableinformation.Penetrationtestingrequiresspecializedskillsandexperienceandmustbeconductedthroughaqualifiedparty.Thetestingmaybeclearboxoropaquebox.</li><li>Safeguard18.3:RemediatePenetrationTestFindings:Remediatepenetrationtestfindingsbasedontheenterprise’spolicyforremediationscopeandprioritization.</li></ul></li><li>Vulnerabilityscanningisusedtofindpotentiallyexploitablesoftwarevulnerabilitiestoremediatethem.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1016-/4t6f57/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1016</a>:VulnerabilityScanning)<ul><li>Safeguard16.13:ConductApplicationPenetrationTesting:Conductapplicationpenetrationtesting.Forcriticalapplications,authenticatedpenetrationtestingisbettersuitedtofindingbusinesslogicvulnerabilitiesthancodescanningandautomatedsecuritytesting.Penetrationtestingreliesontheskillofthetestertomanuallymanipulateanapplicationasanauthenticatedandunauthenticateduser.</li></ul></li><li>ApplythePrincipleofLeastPrivilegetoallsystemsandservices.Runallsoftwareasanon-privilegeduser(onewithoutadministrativeprivileges)todiminishtheeffectsofasuccessfulattack.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1026-/4t6f5b/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1026</a>:PrivilegedAccountManagement)<ul><li>Safeguard4.7:ManageDefaultAccountsonEnterpriseAssetsandSoftware:Managedefaultaccountsonenterpriseassetsandsoftware,suchasroot,administrator,andotherpre-configuredvendoraccounts.Exampleimplementationscaninclude:disablingdefaultaccountsormakingthemunusable.</li><li>Safeguard5.4:RestrictAdministratorPrivilegestoDedicatedAdministratorAccounts:Restrictadministratorprivilegestodedicatedadministratoraccountsonenterpriseassets.Conductgeneralcomputingactivities,suchasinternetbrowsing,email,andproductivitysuiteuse,fromtheuser’sprimary,non-privilegedaccount.</li><li>Safeguard5.5:EstablishandMaintainanInventoryofServiceAccounts:Establishandmaintainaninventoryofserviceaccounts.Theinventory,ataminimum,mustcontaindepartmentowner,reviewdate,andpurpose.Performserviceaccountreviewstovalidatethatallactiveaccountsareauthorized,onarecurringscheduleataminimumquarterly,ormorefrequently</li></ul></li><li>Architectsectionsofthenetworktoisolatecriticalsystems,functions,orresources.Usephysicalandlogicalsegmentationtopreventaccesstopotentiallysensitivesystemsandinformation.UseaDMZtocontainanyinternet-facingservicesthatshouldnotbeexposedfromtheinternalnetwork.Configureseparatevirtualprivatecloud(VPC)instancestoisolatecriticalcloudsystems.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1030-/4t6f5f/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1030</a>:NetworkSegmentation)<ul><li>Safeguard12.2:EstablishandMaintainaSecureNetworkArchitecture:Establishandmaintainasecurenetworkarchitecture.Asecurenetworkarchitecturemustaddresssegmentation,leastprivilege,andavailability,ataminimum.</li></ul></li><li>Usecapabilitiestodetectandblockconditionsthatmayleadtoorbeindicativeofasoftwareexploitoccurring.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1050-/4t6f5j/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1050</a>:ExploitProtection)<ul><li>Safeguard10.5:EnableAnti-ExploitationFeatures:Enableanti-exploitationfeaturesonenterpriseassetsandsoftware,wherepossible,suchasMicrosoft®DataExecutionPrevention(DEP),Windows®DefenderExploitGuard(WDEG),orApple®SystemIntegrityProtection(SIP)andGatekeeper™.</li></ul></li><li>Restrictuseofcertainwebsites,blockdownloads/attachments,blockJavascript,restrictbrowserextensions,etc.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1021-/4t6f5m/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1021</a>:RestrictWeb-BasedContent)<ul><li>Safeguard9.2:UseDNSFilteringServices:UseDNSfilteringservicesonallenterpriseassetstoblockaccesstoknownmaliciousdomains.</li><li>Safeguard9.3:MaintainandEnforceNetwork-BasedURLFilters:Enforceandupdatenetwork-basedURLfilterstolimitanenterpriseassetfromconnectingtopotentiallymaliciousorunapprovedwebsites.Exampleimplementationsincludecategory-basedfiltering,reputation-basedfiltering,orthroughtheuseofblocklists.Enforcefiltersforallenterpriseassets.</li><li>Safeguard9.6:BlockUnnecessaryFileTypes:Blockunnecessaryfiletypesattemptingtoentertheenterprise’semailgateway.</li></ul></li><li>Remindusersnottovisitun-trustedwebsitesorfollowlinksprovidedbyunknownorun-trustedsources.Informandeducateusersregardingthethreatsposedbyhypertextlinkscontainedinemailsorattachmentsespeciallyfromun-trustedsources.(<ahref="https://learn.cisecurity.org/e/799323/mitigations-M1017-/4t6f5q/1255084143?h=JNwLGejOj9pxbAFgXup2w-9UwbqTuFUxOpYaear8KLE">M1017</a>:UserTraining)<ul><li>Safeguard14.1:EstablishandMaintainaSecurityAwarenessProgram:Establishandmaintainasecurityawarenessprogram.Thepurposeofasecurityawarenessprogramistoeducatetheenterprise’sworkforceonhowtointeractwithenterpriseassetsanddatainasecuremanner.Conducttrainingathireand,ataminimum,annually.Reviewandupdatecontentannually,orwhensignificantenterprisechangesoccurthatcouldimpactthisSafeguard.</li><li>Safeguard14.2:TrainWorkforceMemberstoRecognizeSocialEngineeringAttacks:Trainworkforcememberstorecognizesocialengineeringattacks,suchasphishing,pre-texting,andtailgating.</li></ul></li></ul>REFERENCES:<blockquote>Adobe: <ahref="https://helpx.adobe.com/security.html">https://helpx.adobe.com/security.html</a> <ahref="https://helpx.adobe.com/security/products/acrobat/apsb23-34.html">https://helpx.adobe.com/security/products/acrobat/apsb23-34.html</a> <ahref="https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html">https://helpx.adobe.com/security/products/experience-manager/apsb23-43.html</a> <ahref="https://helpx.adobe.com/security/products/connect/apsb23-33.html">https://helpx.adobe.com/security/products/connect/apsb23-33.html</a> CVE: <ahref="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26369">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26369</a> <ahref="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29305">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29305</a> <ahref="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29306">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29306</a> <ahref="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38214">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38214</a> <ahref="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38215">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38215</a></blockquote></div>

21 Nov 2024 07:56Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1

EPSS0.01071

SSVC

CWE-79