Atlassian Confluence Data Center and Confluence Server are vulnerable to a critical vulnerability that could allow attackers to perform remote code execution (RCE). The vulnerability affects all versions released before December 5, 2023, as well as versions that are no longer supported by the company.
The vulnerability (CVE-2023-22527) is considered critical (CVSS v3: 10.0) and is a “template injection” vulnerability that allows unauthorized users to execute code remotely on vulnerable Confluence endpoints.
See also: Atlassian: Fixes critical vulnerabilities in many products
Atlassian emphasizes that the latest supported versions of Confluence Data Center and Server are not affected by this vulnerability. However, the same is not true for previous versions.
Essentially, the vulnerability affects Confluence Data Center and Server versions 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0 through 8.5.3.
Atlassian fixed the flaw in Confluence Data Center and Server versions 8.5.4 (LTS), 8.6.0 (Data Center only), and 8.7.1 (Data Center only), whichwere released in December.
It is worth noting that there are even more recent updates than these, so administrators who have moved to a more recent version are also safe from the CVE-2023-22527 exploit.
Atlassian notes that version 8.4.5 and those that are no longer supported will not receive security. You should upgrade to a supported version.
The company also said that the vulnerability does not affect Confluence LTS v7.19.x, vendor-hosted Cloud Instances, or any other Atlassian product.
See also: Cerber ransomware: Exploits a serious flaw in Atlassian Confluence
However, it is noted that instances that are not connected to the internet and those that do not allow anonymous access are still at risk, although this is reduced.
Those who cannot immediately apply the available updates should take affected systems offline, back up data monitor to a secure location, and for any malicious activity.
What will happen if the update is not applied?
The first and most immediate consequence is the possibility of exploiting the RCE bug by malicious users. This can lead to a loss of control of the system, with attackers being able to execute code on vulnerable devices.
See also: GitHub: Key rotation due to vulnerability that exposed credentials
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Second, failure to fix the error could lead to a data leak. This could include sensitive information, such as personal data, financial details, or company secrets, which could be used for fraud or phishing.
Finally, the attack can cause significant disruption to system operations, which can lead to loss of productivity and additional costs to restore operations.
Source: www.bleepingcomputer.com
