PT-2023-3992 · Atlassian · Confluence

Publicado 2023-07-18 · Atualizado 2023-07-31 · CVE-2023-22505

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server and Data Center versions 8.0.0 through 8.3.1 Atlassian Confluence Server and Data Center versions prior to 8.3.2 and 8.4.0

Description The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary code. This has a high impact on confidentiality, integrity, and availability, with no user interaction required. The vulnerability was discovered by a private user and reported via the Bug Bounty program.

Recommendations For versions 8.0.0 through 8.3.1, upgrade to version 8.3.2 or 8.4.0 to resolve the issue. For versions prior to 8.3.2 and 8.4.0, upgrade to version 8.3.2 or 8.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the server until a patch is applied.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-04290

CVE-2023-22505

Produtos afetados

Confluence

Referências · 10

• https://t.me/cibsecurity/66961 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22505 · Nota de Segurança
• https://cisa.gov/news-events/alerts/2023/07/21/atlassian-releases-security-updates · Nota
• https://jira.atlassian.com/browse/CONFSERVER-88265 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22505 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023072414 · Nota
• https://t.me/thehackernews/3641 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-04290 · Nota de Segurança
• https://t.me/true_secator/4652 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22505 · Nota de Segurança