The widely adopted Atlassian Confluence has been discovered with a zero-day vulnerability, which could allow threat actors to create an admin account on the Confluence servers and perform malicious activities.
This particular issue has been reported by a lot of Atlassian customers and is known to be actively being exploited in the wild by attackers. The vulnerability is currently identified as CVE-2023-22515 and has a severity of 10.0 (Critical), as per Atlassian.
The details of this vulnerability haven’t been disclosed by Atlassian yet. However, as per reports, this vulnerability affects publicly accessible confluence data centers and servers in which threat actors were able to create unauthorized administrator accounts and access confluence instances.
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
“Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously.” reads the security advisory by Atlassian.
Product | Affected Versions | Fixed in Versions |
Confluence Data Center and Confluence Server | 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.1.0, 8.1.1, 8.1.3, 8.1.4, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 8.4.1, 8.4.2, 8.5.0, 8.5.1 | 8.3.3 or later8.4.3 or later8.5.2 (Long Term Support release) or later |
Source: Atlassian
As part of mitigating this issue, Atlassian has recommended its users block access to the /setup/* endpoints on Confluence instances which can be done by the following steps,
<security-constraint> <web-resource-collection> <url-pattern>/setup/*</url-pattern> <http-method-omission>*</http-method-omission> </web-resource-collection> <auth-constraint /> </security-constraint> |
As part of threat detection, Atlassian has recommended its users check all affected Confluence instances for the following indicators of compromise:
For additional information, the Atlassian security advisory can be followed, which can be found here.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by…
A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s Black…
A new information-stealing malware dubbed “PupkinStealer” has emerged as a significant threat to individuals and…
Cybersecurity researchers at Cofense Intelligence have identified a sophisticated phishing tactic leveraging Blob URIs (Uniform…
Broadcom-owned VMware has released security patches addressing a moderate severity insecure file handling vulnerability in…
The open-source penetration testing toolkit Metasploit has unveiled a major update, introducing four new modules,…