Learn

Learn security from the news

Every story has a lesson behind it: the weakness that made it possible, the techniques attackers used, and the controls that stop them. Start from what's happening this month.

1WeaknessWhy it was possible (CWE)
2TechniqueHow attackers use it (ATT&CK)
3ControlWhat stops it (NIST SP 800-53)

Weaknesses in this month's news

The root causes behind the CVEs being covered, most common first.

CWE-30613 CVEsMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
CWE-7910 CVEsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.
CWE-787 CVEsImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
CWE-8637 CVEsIncorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
CWE-896 CVEsImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Input is concatenated into a database query, letting attackers read or change data they shouldn't.
CWE-9185 CVEsServer-Side Request Forgery (SSRF)The server can be made to fetch a URL of the attacker's choosing, often internal services or cloud metadata.
CWE-225 CVEsImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
CWE-7985 CVEsUse of Hard-coded CredentialsA password or key is baked into the product, identical on every install and easy to find.
CWE-4164 CVEsUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
CWE-8624 CVEsMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
CWE-2903 CVEsAuthentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
CWE-1213 CVEsStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.

Techniques threat actors in the news use

From MITRE ATT&CK, for the groups and malware covered this month.

Controls that matter right now

NIST SP 800-53 controls mitigating the most of those techniques.

Browse NIST SP 800-53 control families

AC Access Control · 18
CA Security Assessment and Authorization · 3
CM Configuration Management · 9
CP Contingency Planning · 5
IA Identification and Authentication · 11
MP Media Protection · 1
RA Risk Assessment · 3
SA System and Services Acquisition · 10
SC System and Communications Protection · 34
SI System and Information Integrity · 12
SR Supply Chain Risk Management · 3

Open any control above, or start from a vulnerability and follow its “Learn” panel.

Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.