Vulnerabilityhigh

UK's NHS Digital warns of an RCE in Okta Advanced Server Access client

Security Affairsby @securityaffairsFeb 26, 2022 · 10:45 UTC (Feb 26, 2022)2 min read2 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-24295 CVE-2021-45105 CVE-2021-45046 CVE-2021-44228

Tags: cve-2022-24295 cve-2021-45105 cve-2021-45046 cve-2021-44228 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-44228	JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)	10.0	100%	KEVRansomwarePoC ×9	Dec 10, 2021 KEV Dec 10, 2021
CVE-2021-45046	Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix	9.0	100%	KEVRansomwarePoC	Dec 14, 2021 KEV May 1, 2023
CVE-2021-45105	Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups	5.9	100%		Dec 18, 2021
CVE-2022-24295	Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL	8.8	17%		Feb 21, 2022

From the original article

2 min read at securityaffairs.com

The UK’s NHS Digital agency warns of an RCE in the Windows client for the Okta Advanced Server Access authentication management platform. The UK’s NHS Digital agency published a security advisory to warn organizations of a remote code execution flaw, tracked as CVE-2022-24295 , impacting the Windows client for the Okta Advanced Server Access authentication management platform.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.