PT-2023-32684 · Atlassian · Confluence+2

Camilo Aparecido Ferri Moreira · Publicado 2023-12-04 · Atualizado 2025-10-03 · CVE-2023-6481

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions logback versions 1.2.12 through 1.4.13 Bitbucket Data Center and Server versions 7.21.0 through 8.16.0 Confluence Data Center and Server versions 6.0.1 through 8.7.1

Description A serialization vulnerability in the logback receiver component allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. This issue has no impact on confidentiality, no impact on integrity, but a high impact on availability, and requires no user interaction.

Recommendations For logback versions 1.2.12 through 1.4.13, upgrade to a version later than 1.4.13. For Bitbucket Data Center and Server version 7.21, upgrade to a release greater than or equal to 7.21.19. For Bitbucket Data Center and Server version 8.9, upgrade to a release greater than or equal to 8.9.9. For Bitbucket Data Center and Server version 8.13, upgrade to a release greater than or equal to 8.13.5. For Bitbucket Data Center and Server version 8.14, upgrade to a release greater than or equal to 8.14.4. For Bitbucket Data Center version 8.15, upgrade to a release greater than or equal to 8.15.3. For Bitbucket Data Center version 8.16, upgrade to a release greater than or equal to 8.16.2. For Confluence Data Center, upgrade to the latest version, or to one of the specified supported fixed versions. For Confluence Server, upgrade to the latest 8.5.x LTS version, or to one of the specified supported fixed versions.

Correção

Identificadores relacionados

CVE-2023-6481

GHSA-GM62-RW4G-VRC4

OESA-2023-1946

OPENSUSE-SU-2025:15597-1

Produtos afetados

Bitbucket

Bitbucket Server

Confluence

Referências · 26

• https://github.com/qos-ch/logback · Nota
• https://github.com/qos-ch/logback/commit/c612b2fa3caf6eef3c75f1cd5859438451d0fd6f · Nota
• https://github.com/qos-ch/logback/commit/7018a3609c7bcc9dc7bf5903509901a986e5f578 · Nota
• https://cve.org/CVERecord?id=CVE-2023-6481 · Nota de Segurança
• https://suse.com/security/cve/CVE-2023-6378 · Nota
• https://ubuntu.com/security/CVE-2023-6481 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-6481 · Aviso do Fabricante
• https://jira.atlassian.com/browse/BSERV-19099 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6481 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gm62-rw4g-vrc4 · Aviso do Fabricante
• https://t.me/cvenotify/62798 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2025-11226 · Nota
• https://jira.atlassian.com/browse/CONFSERVER-94111 · Nota
• https://logback.qos.ch/news.html#1.3.12 · Nota
• https://suse.com/security/cve/CVE-2023-6481 · Nota