CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks

The US Cybersecurity & Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, urging federal agencies and large organizations to apply the available security updates as soon as possible. Among them are flaws impacting Microsoft .NET Framework and Apache OFBiz (Open For Business), two widely used software applications. Though the agency has marked those flaws as actively exploited in attacks, it has not provided specific details about the malicious activity, who is conducting it, and against whom. The first flaw, tracked under CVE-2024-29059, is a high severity (CVSS v3 score: 7.5) information disclosure bug in the .NET Framework discovered by CODE WHITE and disclosed to Microsoft in November 2023. Microsoft closed the disclosure report in December 2023, stating, "after careful investigation, we determined this case does not meet our bar for immediate servicing." However, Microsoft ultimately fixed the flaw in the January 2024 security updates but mistakenly did not issue a CVE or acknowledge the researchers. In February, CODE WHITE released technical details and a proof of concept exploit for leaking internal object URIs, which can be used to perform .NET Remoting attacks, Microsoft finally released an advisory for this flaw under CVE-2024-29059 in March 2024 and attributed the discovery to the researchers. The Apache OFBiz flaw is CVE-2024-45195, a critical severity (CVSS v3 score: 9.8) remote code execution vuln...