CISA Adds Five Critical Flaws (ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, ISC BIND) to Known Exploited Vulnerabilities Catalog
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed five high‑severity CVEs—CVE‑2015‑3306, CVE‑2021‑3199, CVE‑2023‑22894, CVE‑2016‑3081, and CVE‑2015‑5477—into its Known Exploited Vulnerabilities (KEV) catalog. These flaws affect widely deployed services (FTP, document editing, headless CMS, web‑framework, DNS) and have been linked to China‑linked espionage actors.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous vulnerability‑management program that can detect, prioritize, and remediate known‑exploited flaws before attackers leverage them.
- Provides concrete evidence for audit readiness: documented patch cycles, risk‑based scoring, and proof of remediation map to the “Vulnerability Management” control objective across multiple frameworks (e.g., NIST CSF 2.0 Identify ID.BE‑5).
- Highlights the importance of a control‑mapping capability that translates CVE data into actionable control evidence for regulators and partners.
Who Is Affected – Organizations that run any of the listed components, spanning SaaS platforms, on‑premises web applications, DNS infrastructure, and file‑transfer services—commonly found in technology, cloud, and managed‑service environments.
Recommended Actions
- Verify whether any of the five vulnerable components are present in your asset inventory.
- Prioritize patching or applying vendor mitigations based on CVSS scores (10.0 → critical).
- Capture remediation tickets, patch‑deployment logs, and verification scans as continuous control evidence.
- Integrate CISA’s KEV feed into your vulnerability‑scanning pipeline for automated alerting.
Source: Security Affairs
Technical Notes
- ProFTPD (CVE‑2015‑3306) – Remote file read/write via SITE CPFR/CPTO (CVSS 10.0).
- ONLYOFFICE Docs (CVE‑2021‑3199) – Path‑traversal in image upload when JWT enabled, leading to remote code execution (CVSS 9.8).
- Strapi (CVE‑2023‑22894) – Clear‑text exposure of user data via admin‑panel query filters (CVSS 7.2).
- Apache Struts (CVE‑2016‑3081) – Command injection via Dynamic Method Invocation (CVSS 8.1).
- ISC BIND (CVE‑2015‑5477) – Reachable assertion triggered by crafted TKEY queries, causing DoS (CVSS 7.5).
Source: same as above