Select Profile Benchmark
Top 5 Priorities for Healthcare Patient Portal
1
URGENT
CVE-2023-22515
Privilege escalation vulnerability in Atlassian Confluence Data Center and Se...
Why: The organisation uses confluence_data_center, which is affected by CVE-2023-22515. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.1% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review the vendor advisory for CVE-2023-22515 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-22515
2
URGENT
CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 117
Why: The organisation uses libwebp, which is affected by CVE-2023-4863. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 95.2% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review the vendor advisory for CVE-2023-4863 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-4863
3
EXCLUDED
CVE-2021-44228
Log4Shell: Unauthenticated Remote Code Execution via JNDI injection in Apache...
Why: CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.5% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review CVE-2021-44228 and confirm whether log4j is in use.
4
EXCLUDED
CVE-2020-1472
Zerologon: Unauthenticated privilege escalation vulnerability in Microsoft Ne...
Why: CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.5% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review CVE-2020-1472 and confirm whether netlogon is in use.
5
EXCLUDED
CVE-2023-20198
Unauthenticated privilege escalation in Cisco IOS XE Web UI software
Why: CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.4% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Action: Review CVE-2023-20198 and confirm whether ios_xe is in use.
Excluded High-CVSS (Negative Test)
CVE-2021-44228
CVE-2021-44228 has a CVSS score of 10.0 but was excluded because the organisation does not use log4j. A high CVSS score alone does not make a vulnerability relevant.
CVE-2020-1472
CVE-2020-1472 has a CVSS score of 10.0 but was excluded because the organisation does not use netlogon. A high CVSS score alone does not make a vulnerability relevant.
CVE-2023-20198
CVE-2023-20198 has a CVSS score of 10.0 but was excluded because the organisation does not use ios_xe. A high CVSS score alone does not make a vulnerability relevant.
CVE-2023-22527
CVE-2023-22527 has a CVSS score of 10.0 but was excluded because the installed version is outside the affected range. Installed version 8.5.1 does not match the affected version(s) 8.5.3.
CVE-2023-38606
CVE-2023-38606 has a CVSS score of 9.8 but was excluded because the organisation does not use ofbiz. A high CVSS score alone does not make a vulnerability relevant.