diff --git a/src/content/docs/waf/change-log/2025-07-21.mdx b/src/content/docs/waf/change-log/2025-07-21.mdx new file mode 100644 index 000000000000000..9d1a8c5db47496d --- /dev/null +++ b/src/content/docs/waf/change-log/2025-07-21.mdx @@ -0,0 +1,105 @@ +--- +title: "2025-07-21" +type: table +pcx_content_type: release-notes +sidebar: + order: 782 +tableOfContents: false +--- + +import { RuleID } from "~/components"; + +This week’s update spotlights several critical vulnerabilities across Citrix NetScaler Memory Disclosure, FTP servers and network application. Several flaws enable unauthenticated remote code execution or sensitive data exposure, posing a significant risk to enterprise security. + +**Key Findings** + +- Wing FTP Server (CVE-2025-47812): A critical Remote Code Execution (RCE) vulnerability that enables unauthenticated attackers to execute arbitrary code with root/SYSTEM-level privileges by exploiting a Lua injection flaw. +- Infoblox NetMRI (CVE-2025-32813): A remote unauthenticated command injection flaw that allows an attacker to execute arbitrary commands, potentially leading to unauthorized access. +- Citrix Netscaler ADC (CVE-2025-5777, CVE-2023-4966): A sensitive information disclosure vulnerability, also known as "Citrix Bleed2", that allows the disclosure of memory and subsequent remote access session hijacking. +- Akamai CloudTest (CVE-2025-49493): An XML External Entity (XXE) injection that could lead to read local files on the system by manipulating XML input. + +**Impact** + +These vulnerabilities affect critical enterprise infrastructure, from file transfer services and network management appliances to application delivery controllers. The Wing FTP RCE and Infoblox command injection flaws offer direct paths to deep system compromise, while the Citrix "Bleed2" and Akamai XXE vulnerabilities undermine system integrity by enabling session hijacking and sensitive data theft. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset + + 100804BerriAI - SSRF - CVE:CVE-2024-6587LogLogThis is a New Detection
Cloudflare Managed Ruleset + + 100805Wing FTP Server - Remote Code Execution - CVE:CVE-2025-47812LogBlockThis is a New Detection
Cloudflare Managed Ruleset + + 100807Infoblox NetMRI - Command Injection - CVE:CVE-2025-32813LogBlockThis is a New Detection
Cloudflare Managed Ruleset + + 100808Citrix Netscaler ADC - Buffer Error - CVE:CVE-2025-5777LogDisabledThis is a New Detection
Cloudflare Managed Ruleset + + 100809Citrix Netscaler ADC - Information Disclosure - CVE:CVE-2023-4966LogBlockThis is a New Detection
Cloudflare Managed Ruleset + + 100810Akamai CloudTest - XXE - CVE:CVE-2025-49493LogBlockThis is a New Detection
\ No newline at end of file diff --git a/src/content/docs/waf/change-log/scheduled-changes.mdx b/src/content/docs/waf/change-log/scheduled-changes.mdx index 1ba4aeada5e6dff..ed613e061fcbfb2 100644 --- a/src/content/docs/waf/change-log/scheduled-changes.mdx +++ b/src/content/docs/waf/change-log/scheduled-changes.mdx @@ -23,72 +23,50 @@ import { RSSButton, RuleID } from "~/components"; Comments - + - 2025-07-14 - 2025-07-21 - Log - 100804 - - - - BerriAI - SSRF - CVE:CVE-2024-6587 - This is a New Detection - - - 2025-07-14 - 2025-07-21 - Log - 100805 - - - - Wing FTP Server - Remote Code Execution - CVE:CVE-2025-47812 - This is a New Detection - - - 2025-07-14 - 2025-07-21 - Log - 100807 - - - - Infoblox NetMRI - Command Injection - CVE:CVE-2025-32813 - This is a New Detection + 2025-07-21 + 2025-07-28 + Log + 100812 + + + + Fortinet FortiWeb - Remote Code Execution - CVE:CVE-2025-25257 + This is a New Detection - 2025-07-14 - 2025-07-21 - Log - 100808 - - - - Citrix Netscaler ADC - Buffer Error - CVE:CVE-2025-5777 - This is a New Detection + 2025-07-21 + 2025-07-28 + Log + 100813 + + + + Apache Tomcat - DoS - CVE:CVE-2025-31650 + This is a New Detection - 2025-07-14 - 2025-07-21 - Log - 100809 - - - - Citrix Netscaler ADC - Information Disclosure - CVE:CVE-2023-4966 - This is a New Detection + 2025-07-21 + 2025-07-28 + Log + 100815 + + + + MongoDB - Remote Code Execution - CVE:CVE-2024-53900, CVE:CVE-2025-23061 + This is a New Detection - 2025-07-14 - 2025-07-21 - Log - 100810 - - - - Akamai CloudTest - XXE - CVE:CVE-2025-49493 - This is a New Detection + 2025-07-21 + 2025-07-28 + Log + 100816 + + + + MongoDB - Remote Code Execution - CVE:CVE-2024-53900, CVE:CVE-2025-23061 + This is a New Detection - + \ No newline at end of file diff --git a/src/content/release-notes/waf.yaml b/src/content/release-notes/waf.yaml index 3112371b6067a69..02009726bd3bf18 100644 --- a/src/content/release-notes/waf.yaml +++ b/src/content/release-notes/waf.yaml @@ -5,11 +5,14 @@ productLink: "/waf/" productArea: Application security productAreaLink: /fundamentals/reference/changelog/security/ entries: - - publish_date: "2025-07-14" - scheduled_date: "2025-07-21" + - publish_date: "2025-07-21" + scheduled_date: "2025-07-28" individual_page: true scheduled: true link: "/waf/change-log/scheduled-changes/" + - publish_date: "2025-07-21" + individual_page: true + link: "/waf/change-log/2025-07-21/" - publish_date: "2025-07-14" individual_page: true link: "/waf/change-log/2025-07-14/"