51 lines
3.2 KiB
Go
51 lines
3.2 KiB
Go
package vulnprobe
|
|
|
|
// CatalogEntry describes a CISA KEV-style CVE family for read-only exposure checks.
|
|
type CatalogEntry struct {
|
|
ID string
|
|
Name string
|
|
Component string
|
|
Severity string
|
|
Description string
|
|
// PatchKBs are Windows KB IDs that mitigate this CVE (subset for lightweight correlator).
|
|
PatchKBs []string
|
|
// FleetPorts are listener ports that raise fleet-context exploitability when open.
|
|
FleetPorts []int
|
|
}
|
|
|
|
// Catalog aligns with CISA AA22-117A / AA22-279A top exploited CVE families.
|
|
var Catalog = []CatalogEntry{
|
|
{ID: "CVE-2021-44228", Name: "Log4Shell", Component: "Apache Log4j", Severity: "critical",
|
|
Description: "JNDI RCE in Log4j 2.x before 2.17.0"},
|
|
{ID: "CVE-2021-26855", Name: "ProxyLogon", Component: "Microsoft Exchange", Severity: "critical",
|
|
Description: "Exchange Server pre-auth SSRF chain (Mar 2021)", PatchKBs: []string{"KB5000871", "KB5000978"},
|
|
FleetPorts: []int{443, 80}},
|
|
{ID: "CVE-2020-1472", Name: "Zerologon", Component: "Microsoft Netlogon", Severity: "critical",
|
|
Description: "Domain controller Netlogon privilege escalation", PatchKBs: []string{"KB4577015"},
|
|
FleetPorts: []int{445, 135}},
|
|
{ID: "CVE-2019-19781", Name: "Citrix ADC", Component: "Citrix ADC/Gateway", Severity: "critical",
|
|
Description: "Path traversal on Citrix Application Delivery Controller", FleetPorts: []int{443}},
|
|
{ID: "CVE-2019-11510", Name: "Pulse Secure", Component: "Ivanti Pulse Connect Secure", Severity: "critical",
|
|
Description: "Arbitrary file read on Pulse VPN appliances", FleetPorts: []int{443}},
|
|
{ID: "CVE-2020-5902", Name: "F5 BIG-IP", Component: "F5 BIG-IP", Severity: "critical",
|
|
Description: "Remote code execution in TMUI", FleetPorts: []int{443, 8443}},
|
|
{ID: "CVE-2022-1388", Name: "F5 iControl", Component: "F5 BIG-IP", Severity: "critical",
|
|
Description: "iControl REST auth bypass (May 2022)", FleetPorts: []int{443, 8443}},
|
|
{ID: "CVE-2021-26084", Name: "Confluence OGNL", Component: "Atlassian Confluence", Severity: "critical",
|
|
Description: "Confluence Server/Data Center RCE", FleetPorts: []int{8090, 8443}},
|
|
{ID: "CVE-2022-26134", Name: "Confluence RCE", Component: "Atlassian Confluence", Severity: "critical",
|
|
Description: "Confluence unauthenticated RCE (2022)", FleetPorts: []int{8090, 8443}},
|
|
{ID: "CVE-2021-40539", Name: "ManageEngine", Component: "Zoho ManageEngine ADSelfService Plus", Severity: "critical",
|
|
Description: "Unauthenticated RCE in ADSelfService Plus", FleetPorts: []int{9251}},
|
|
{ID: "CVE-2018-13379", Name: "FortiOS path traversal", Component: "Fortinet FortiGate/FortiOS", Severity: "critical",
|
|
Description: "SSL-VPN path traversal (FortiOS)", FleetPorts: []int{443, 10443}},
|
|
{ID: "CVE-2021-34527", Name: "PrintNightmare", Component: "Windows Print Spooler", Severity: "high",
|
|
Description: "Spooler remote code execution (Jul 2021)", PatchKBs: []string{"KB5004945"},
|
|
FleetPorts: []int{445, 135}},
|
|
{ID: "CVE-2020-0688", Name: "Exchange RCE", Component: "Microsoft Exchange", Severity: "high",
|
|
Description: "Exchange control panel deserialization RCE", PatchKBs: []string{"KB4537676"},
|
|
FleetPorts: []int{443}},
|
|
{ID: "CVE-2021-21972", Name: "vCenter RCE", Component: "VMware vCenter", Severity: "critical",
|
|
Description: "vSphere Client RCE in vCenter Server", FleetPorts: []int{443}},
|
|
}
|