Skip to content

Commit 1dd3179

Browse files
fb1337sdnts
fb1337
authored and
sdnts
committed
Release June 9th - 2025 (cloudflare#22965)
* Release June 9th - 2025 * minor fixes
1 parent 40cec1d commit 1dd3179

File tree

3 files changed

+148
-18
lines changed

3 files changed

+148
-18
lines changed

‎src/content/docs/waf/change-log/2025-06-09.mdx‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: "2025-06-09"
3+
type: table
4+
pcx_content_type: release-notes
5+
sidebar:
6+
order: 786
7+
tableOfContents: false
8+
---
9+
10+
import { RuleID } from "~/components";
11+
12+
This week’s update spotlights four critical vulnerabilities across CMS platforms, VoIP systems, and enterprise applications. Several flaws enable remote code execution or privilege escalation, posing significant enterprise risks.
13+
14+
**Key Findings**
15+
16+
- WordPress OttoKit Plugin (CVE-2025-27007): Privilege escalation flaw allows unauthenticated attackers to create or elevate user accounts, compromising WordPress administrative control.
17+
- SAP NetWeaver (CVE-2025-42999): Remote Code Execution vulnerability enables attackers to execute arbitrary code on SAP NetWeaver systems, threatening core ERP and business operations.
18+
- Fortinet FortiVoice (CVE-2025-32756): Buffer error vulnerability may lead to memory corruption and potential code execution, directly impacting enterprise VoIP infrastructure.
19+
- Camaleon CMS (CVE-2024-46986): Remote Code Execution vulnerability allows attackers to gain full control over Camaleon CMS installations, exposing hosted content and underlying servers.
20+
21+
**Impact**
22+
23+
These vulnerabilities target widely deployed CMS, ERP, and VoIP systems. RCE flaws in SAP NetWeaver and Camaleon CMS allow full takeover of business-critical applications. Privilege escalation in OttoKit exposes WordPress environments to full administrative compromise. FortiVoice buffer handling issues risk destabilizing or fully compromising enterprise telephony systems.
24+
25+
<table style="width: 100%">
26+
<thead>
27+
<tr>
28+
<th>Ruleset</th>
29+
<th>Rule ID</th>
30+
<th>Legacy Rule ID</th>
31+
<th>Description</th>
32+
<th>Previous Action</th>
33+
<th>New Action</th>
34+
<th>Comments</th>
35+
</tr>
36+
</thead>
37+
<tbody>
38+
<tr>
39+
<td>Cloudflare Managed Ruleset</td>
40+
<td>
41+
<RuleID id="4afd50a3ef1948bba87c4e620debd86e" />
42+
</td>
43+
<td>100769</td>
44+
<td>WordPress OttoKit Plugin - Privilege Escalation - CVE:CVE-2025-27007</td>
45+
<td>Log</td>
46+
<td>Block</td>
47+
<td>This is a New Detection</td>
48+
</tr>
49+
<tr>
50+
<td>Cloudflare Managed Ruleset</td>
51+
<td>
52+
<RuleID id="24134c41c3e940daa973b4b95f57b448" />
53+
</td>
54+
<td>100770</td>
55+
<td>SAP NetWeaver - Remote Code Execution - CVE:CVE-2025-42999</td>
56+
<td>Log</td>
57+
<td>Block</td>
58+
<td>This is a New Detection</td>
59+
</tr>
60+
<tr>
61+
<td>Cloudflare Managed Ruleset</td>
62+
<td>
63+
<RuleID id="4f219ac0be3545a5be5f0bf34df8857a" />
64+
</td>
65+
<td>100779</td>
66+
<td>Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756</td>
67+
<td>Log</td>
68+
<td>Block</td>
69+
<td>This is a New Detection</td>
70+
</tr>
71+
<tr>
72+
<td>Cloudflare Managed Ruleset</td>
73+
<td>
74+
<RuleID id="bc8dfbe8cbac4c039725ec743b840107" />
75+
</td>
76+
<td>100780</td>
77+
<td>Camaleon CMS - Remote Code Execution - CVE:CVE-2024-46986</td>
78+
<td>Log</td>
79+
<td>Block</td>
80+
<td>This is a New Detection</td>
81+
</tr>
82+
</tbody>
83+
</table>

‎src/content/docs/waf/change-log/scheduled-changes.mdx‎

Lines changed: 60 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -25,47 +25,91 @@ import { RSSButton, RuleID } from "~/components";
2525
</thead>
2626
<tbody>
2727
<tr>
28-
<td>2025-06-02</td>
2928
<td>2025-06-09</td>
29+
<td>2025-06-16</td>
3030
<td>Log</td>
31-
<td>100769</td>
31+
<td>100783</td>
3232
<td>
33-
<RuleID id="4afd50a3ef1948bba87c4e620debd86e" />
33+
<RuleID id="233bcf0ce50f400989a7e44a35fefd53" />
3434
</td>
35-
<td>WordPress OttoKit Plugin - Privilege Escalation - CVE:CVE-2025-27007</td>
35+
<td>Cisco IOS XE - Remote Code Execution - CVE:CVE-2025-20188</td>
3636
<td>This is a New Detection</td>
3737
</tr>
3838
<tr>
39-
<td>2025-06-02</td>
4039
<td>2025-06-09</td>
40+
<td>2025-06-16</td>
4141
<td>Log</td>
42-
<td>100770</td>
42+
<td>100784</td>
4343
<td>
44-
<RuleID id="24134c41c3e940daa973b4b95f57b448" />
44+
<RuleID id="9284e3b1586341acb4591bfd8332af5d" />
4545
</td>
46-
<td>SAP NetWeaver - Remote Code Execution - CVE:CVE-2025-42999</td>
46+
<td>Axios - SSRF - CVE:CVE-2024-39338</td>
4747
<td>This is a New Detection</td>
4848
</tr>
4949
<tr>
50-
<td>2025-06-02</td>
5150
<td>2025-06-09</td>
51+
<td>2025-06-16</td>
5252
<td>Log</td>
53-
<td>100779</td>
53+
<td>100785</td>
5454
<td>
55-
<RuleID id="4f219ac0be3545a5be5f0bf34df8857a" />
55+
<RuleID id="2672b175a25548aa8e0107b12e1648d2" />
5656
</td>
57-
<td>Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756</td>
57+
<td>vBulletin - Remote Code Execution - CVE:CVE-2025-48827, CVE:CVE-2025-48828</td>
5858
<td>This is a New Detection</td>
5959
</tr>
6060
<tr>
61-
<td>2025-06-02</td>
6261
<td>2025-06-09</td>
62+
<td>2025-06-16</td>
6363
<td>Log</td>
64-
<td>100780</td>
64+
<td>100786</td>
6565
<td>
66-
<RuleID id="bc8dfbe8cbac4c039725ec743b840107" />
66+
<RuleID id="b77a19fb053744b49eacdab00edcf1ef" />
6767
</td>
68-
<td>Camaleon CMS - Remote Code Execution - CVE:CVE-2024-46986</td>
68+
<td>Invision Community - Remote Code Execution - CVE:CVE-2025-47916</td>
69+
<td>This is a New Detection</td>
70+
</tr>
71+
<tr>
72+
<td>2025-06-09</td>
73+
<td>2025-06-16</td>
74+
<td>Log</td>
75+
<td>100791</td>
76+
<td>
77+
<RuleID id="aec2274743064523a9667248d6f5eb48" />
78+
</td>
79+
<td>CrushFTP - SSRF - CVE:CVE-2025-32102, CVE:CVE-2025-32103</td>
80+
<td>This is a New Detection</td>
81+
</tr>
82+
<tr>
83+
<td>2025-06-09</td>
84+
<td>2025-06-16</td>
85+
<td>Log</td>
86+
<td>100792</td>
87+
<td>
88+
<RuleID id="7b80e1f5575d4d99bb7d56ae30baa18a" />
89+
</td>
90+
<td>Roundcube - Remote Code Execution - CVE:CVE-2025-49113</td>
91+
<td>This is a New Detection</td>
92+
</tr>
93+
<tr>
94+
<td>2025-06-09</td>
95+
<td>2025-06-16</td>
96+
<td>Log</td>
97+
<td>100793</td>
98+
<td>
99+
<RuleID id="52d76f9394494b0382c7cb00229ba236" />
100+
</td>
101+
<td>XSS - Ontoggle</td>
102+
<td>This is a New Detection</td>
103+
</tr>
104+
<tr>
105+
<td>2025-06-09</td>
106+
<td>2025-06-16</td>
107+
<td>Log</td>
108+
<td>100794</td>
109+
<td>
110+
<RuleID id="d38e657bd43f4d809c28157dfa338296" />
111+
</td>
112+
<td>WordPress WooCommerce Plugin - Dangerous File Upload - CVE:CVE-2025-47577</td>
69113
<td>This is a New Detection</td>
70114
</tr>
71115
</tbody>

‎src/content/release-notes/waf.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@ productLink: "/waf/"
55
productArea: Application security
66
productAreaLink: /fundamentals/reference/changelog/security/
77
entries:
8-
- publish_date: "2025-06-02"
9-
scheduled_date: "2025-06-09"
8+
- publish_date: "2025-06-09"
9+
scheduled_date: "2025-06-16"
1010
individual_page: true
1111
scheduled: true
1212
link: "/waf/change-log/scheduled-changes/"
13+
- publish_date: "2025-06-09"
14+
individual_page: true
15+
link: "/waf/change-log/2025-06-09/"
1316
- publish_date: "2025-06-02"
1417
individual_page: true
1518
link: "/waf/change-log/2025-06-02/"

0 commit comments

Comments
 (0)