A max-critical unauthenticated distant code execution (RCE) vulnerability is impacting Atlassian Confluence Knowledge Middle and Confluence Server, in all variations launched earlier than Dec. 5. Unpatched organizations ought to put together to defend in opposition to the whole lot from ransomware campaigns to cyber-espionage makes an attempt.
The bug (CVE-2023-22527), which carries a ten out of 10 vulnerability-severity score on the CVSS v3 scale, is a template injection vulnerability that paves the way in which for unauthenticated attackers to attain RCE on variations 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and eight.5.0 via 8.5.3.
Bug Plagues Most Variations of Confluence
Any group that has upgraded to Confluence variations launched within the firm’s December replace are within the clear, although the bug was disclosed simply at the moment, together with a number of less-severe vulnerabilities which are newly patched in a contemporary safety bulletin.
Atlassian famous that end-of-life cases (model 8.4.5 and earlier than) are additionally affected and won’t obtain patches.
There aren’t any mitigations or workarounds accessible, so admins ought to apply the newest variations from final month to be totally protected, even when their variations of Confluence aren’t uncovered to the Web. Cloud cases are unaffected.
For many who cannot instantly patch their Confluence Knowledge Middle and Server cases, Atlassian recommends they take away their programs from the Web and again up their knowledge outdoors of the Confluence atmosphere.
Atlassian CVE-2023-22527 Assaults Might Be Extensive-Ranging
The corporate additionally advised monitoring for any potential malicious exercise (naturally) however famous in its safety advisory on CVE-2024-22527 that “the opportunity of a number of entry factors, together with chained assaults, makes it tough to checklist all doable indicators of compromise.”
Admins ought to take notice: Atlassian Confluence bugs are typically standard on the cybercrime circuit, provided that the platform reaches deep into community environments, used for cross-enterprise collaboration, workflow, and software program improvement. One other 10-out-of-10 important bug in November was swarmed with exploitation makes an attempt inside days of its disclosure, and it is doubtless the identical will maintain true for this one if previous is prologue; with Atlassian, it often is.
