Saltstack Remote Code Execution (RCE) Vulnerability
For those that have implemented SaltStack in your cloud environment, please be aware of several vulnerabilities (CVE-2020-11651/CVE-2020-11652) that together allow a RCE condition, which could allow an attacker to take over your Master Salt server and then laterally move to your Salt minions. Please consider patching with release 3000.2 or adding controls to block access to the Salt Master’s default ports of tcp 4505 and 4506 from unnecessary hosts. For more information, please visit: https://community.saltstack.com/blog/critical-vulnerabilities-update-cve-2020-11651-and-cve-2020-11652/
Frontline.Cloud includes check 133836 SaltStack Salt Improper Method Call Validation, a Critical severity added May 8, 2020.
vBulletin “incorrect access control” Vulnerability
vBulletin’s latest vulnerability (CVE-2020-12720) allows an attacker to use unauthenticated SQL injection to gain credentials for the Administrator that could be used for authenticated remote code execution (RCE). If you are using vBulletin, please patch versions before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1. For details, please see https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4440032-vbulletin-5-5-6-5-6-0-5-6-1-security-patch-level-1
Frontline.Cloud includes check 134005 Internet Brands vBulletin Incorrect Access Control, a High severity added May 28, 2020.