Monday, December 4, 2023

Atlassian Urged Customers to Fix Critical Confluence Flaw Right Away!

Atlassian has been reported with a critical vulnerability in their Confluence Software, which several organizations have widely adopted.

The CVE for this vulnerability has been assigned as CVE-2023-22518, and the severity has been given as 9.1 (Critical).

Atlassian has addressed this vulnerability in its recent security advisory and fixed it on its latest version. Additionally, they have also released affected versions of Confluence for this vulnerability.

CVE-2023-22518 – Improper Authorization Vulnerability

This vulnerability affects Confluence Data Center and Server customers, potentially leading to significant data loss if exploited by an unauthenticated threat actor. Atlassian hasn’t released any additional details about this vulnerability.

“As part of our continuous security assessment processes, we have discovered that Confluence Data Center and Server customers are vulnerable to significant data loss if exploited by an unauthenticated attacker. There are no reports of active exploitation at this time; however, customers must take immediate action to protect their instances. Please read the Critical Security Advisory below for instructions and vulnerability details,” reads the advisory by Atlassian.

Atlassian also confirmed that publicly accessible Confluence Data Center and Server versions are at critical risk and require immediate attention.

Affected Versions and Fix 

ProductAffected VersionsFixed Versions
Confluence Data Center and ServerAll versions are affected7.19.16 or later8.3.4 or later8.4.4 or later8.5.3 or later8.6.1 or later

Mitigation

To mitigate this issue, Atlassian has recommended their users “Back up the instance” and, if possible, “Remove the instance from the internet until this can be patched.”

Users of these products should upgrade to the latest versions to prevent these vulnerabilities from getting exploited. 

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.

Website

Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles