From d2c57281f9e237e4a30244f145bec1a7dd6371f3 Mon Sep 17 00:00:00 2001 From: fb1337 Date: Mon, 9 Jun 2025 13:39:50 -0400 Subject: [PATCH 1/2] Release June 9th - 2025 --- .../docs/waf/change-log/2025-06-09.mdx | 83 +++++++++++++++++++ .../docs/waf/change-log/scheduled-changes.mdx | 76 +++++++++++++---- src/content/release-notes/waf.yaml | 7 +- 3 files changed, 148 insertions(+), 18 deletions(-) create mode 100644 src/content/docs/waf/change-log/2025-06-09.mdx diff --git a/src/content/docs/waf/change-log/2025-06-09.mdx b/src/content/docs/waf/change-log/2025-06-09.mdx new file mode 100644 index 00000000000000..1c7c422bbb04e4 --- /dev/null +++ b/src/content/docs/waf/change-log/2025-06-09.mdx @@ -0,0 +1,83 @@ +--- +title: "2025-06-09" +type: table +pcx_content_type: release-notes +sidebar: + order: 786 +tableOfContents: false +--- + +import { RuleID } from "~/components"; + +This week’s update spotlights four critical vulnerabilities across CMS platforms, VoIP systems, and enterprise applications. Several flaws enable remote code execution or privilege escalation, posing significant enterprise risks. + +**Key Findings** + +- WordPress OttoKit Plugin (CVE-2025-27007): Privilege escalation flaw allows unauthenticated attackers to create or elevate user accounts, compromising WordPress administrative control. +- SAP NetWeaver (CVE-2025-42999): Remote Code Execution vulnerability enables attackers to execute arbitrary code on SAP NetWeaver systems, threatening core ERP and business operations. +- Fortinet FortiVoice (CVE-2025-32756): Buffer error vulnerability may lead to memory corruption and potential code execution, directly impacting enterprise VoIP infrastructure. +- Camaleon CMS (CVE-2024-46986): Remote Code Execution vulnerability allows attackers to gain full control over Camaleon CMS installations, exposing hosted content and underlying servers. + +**Impact** + +These vulnerabilities target widely deployed CMS, ERP, and VoIP systems. RCE flaws in SAP NetWeaver and Camaleon CMS allow full takeover of business-critical applications. Privilege escalation in OttoKit exposes WordPress environments to full administrative compromise. FortiVoice buffer handling issues risk destabilizing or fully compromising enterprise telephony systems. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset + + 100769WordPress OttoKit Plugin - Privilege Escalation - CVE:CVE-2025-27007LogBlockThis is a New Detection
Cloudflare Managed Ruleset + + 100770SAP NetWeaver - Remote Code Execution - CVE:CVE-2025-42999LogBlockThis is a New Detection
Cloudflare Managed Ruleset + + 100779cLogBlockThis is a New Detection
Cloudflare Managed Ruleset + + 100780Camaleon CMS - Remote Code Execution - CVE:CVE-2024-46986LogBlockThis is a New Detection
\ No newline at end of file diff --git a/src/content/docs/waf/change-log/scheduled-changes.mdx b/src/content/docs/waf/change-log/scheduled-changes.mdx index 64628e4087c51e..b195aca520bac8 100644 --- a/src/content/docs/waf/change-log/scheduled-changes.mdx +++ b/src/content/docs/waf/change-log/scheduled-changes.mdx @@ -25,47 +25,91 @@ import { RSSButton, RuleID } from "~/components"; - 2025-06-02 2025-06-09 + 2025-06-16 Log - 100769 + 100783 - + - WordPress OttoKit Plugin - Privilege Escalation - CVE:CVE-2025-27007 + Cisco IOS XE - Remote Code Execution - CVE:CVE-2025-20188 This is a New Detection - 2025-06-02 2025-06-09 + 2025-06-16 Log - 100770 + 100784 - + - SAP NetWeaver - Remote Code Execution - CVE:CVE-2025-42999 + Axios - SSRF - CVE:CVE-2024-39338 This is a New Detection - 2025-06-02 2025-06-09 + 2025-06-16 Log - 100779 + 100785 - + - Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756 + vBulletin - Remote Code Execution - CVE:cc, CVE:CVE-2025-48828 This is a New Detection - 2025-06-02 2025-06-09 + 2025-06-16 Log - 100780 + 100786 - + - Camaleon CMS - Remote Code Execution - CVE:CVE-2024-46986 + Invision Community - Remote Code Execution - CVE:CVE-2025-47916 + This is a New Detection + + + 2025-06-09 + 2025-06-16 + Log + 100791 + + + + CrushFTP - SSRF - CVE:CVE-2025-32102, CVE:CVE-2025-32103 + This is a New Detection + + + 2025-06-09 + 2025-06-16 + Log + 100792 + + + + Roundcube - Remote Code Execution - CVE:CVE-2025-49113 + This is a New Detection + + + 2025-06-09 + 2025-06-16 + Log + 100793 + + + + XSS - Ontoggle + This is a New Detection + + + 2025-06-09 + 2025-06-16 + Log + 100794 + + + + WordPress WooCommerce Plugin - Dangerous File Upload - CVE:CVE-2025-47577 This is a New Detection diff --git a/src/content/release-notes/waf.yaml b/src/content/release-notes/waf.yaml index db87d950b1cebe..3e59efdcffdce1 100644 --- a/src/content/release-notes/waf.yaml +++ b/src/content/release-notes/waf.yaml @@ -5,11 +5,14 @@ productLink: "/waf/" productArea: Application security productAreaLink: /fundamentals/reference/changelog/security/ entries: - - publish_date: "2025-06-02" - scheduled_date: "2025-06-09" + - publish_date: "2025-06-09" + scheduled_date: "2025-06-16" individual_page: true scheduled: true link: "/waf/change-log/scheduled-changes/" + - publish_date: "2025-06-09" + individual_page: true + link: "/waf/change-log/2025-06-09/" - publish_date: "2025-06-02" individual_page: true link: "/waf/change-log/2025-06-02/" From 705507cc3e39e696b5e935a5486d6c5ba83f0911 Mon Sep 17 00:00:00 2001 From: fb1337 Date: Mon, 9 Jun 2025 13:44:41 -0400 Subject: [PATCH 2/2] minor fixes --- src/content/docs/waf/change-log/2025-06-09.mdx | 2 +- src/content/docs/waf/change-log/scheduled-changes.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/waf/change-log/2025-06-09.mdx b/src/content/docs/waf/change-log/2025-06-09.mdx index 1c7c422bbb04e4..483df7a37196b8 100644 --- a/src/content/docs/waf/change-log/2025-06-09.mdx +++ b/src/content/docs/waf/change-log/2025-06-09.mdx @@ -63,7 +63,7 @@ These vulnerabilities target widely deployed CMS, ERP, and VoIP systems. RCE fla 100779 - c + Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756 Log Block This is a New Detection diff --git a/src/content/docs/waf/change-log/scheduled-changes.mdx b/src/content/docs/waf/change-log/scheduled-changes.mdx index b195aca520bac8..bfe80433fe7e0d 100644 --- a/src/content/docs/waf/change-log/scheduled-changes.mdx +++ b/src/content/docs/waf/change-log/scheduled-changes.mdx @@ -54,7 +54,7 @@ import { RSSButton, RuleID } from "~/components"; - vBulletin - Remote Code Execution - CVE:cc, CVE:CVE-2025-48828 + vBulletin - Remote Code Execution - CVE:CVE-2025-48827, CVE:CVE-2025-48828 This is a New Detection