The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have now issued an alert about the problem of directory traversal flaws, responding to recent incidents targeting healthcare organizations.
CISA said there were 55 directory traversal vulnerabilities listed in its Known Exploited Vulnerabilities (KEV) catalog, with examples like CVE-2024-1708 in ConnectWise ScreenConnect and CVE-2024-20345 in Cisco AppDynamics Controller.
Software companies are urged to test for similar flaws and implement mitigations, ensuring products are secure from vulnerabilities like directory traversal. Prevention involves building security into products from the beginning.
Collection
[
|
...
]