PT-2023-7517 · Atlassian · Confluence

Sharada Moorthy · Publicado 2023-01-01 · Atualizado 2024-01-02 · CVE-2023-22522

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server versions 4.x.x through 8.5.3 Atlassian Confluence Data Center versions 4.x.x through 8.6.1

Description This issue allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page, achieving Remote Code Execution (RCE) on an affected instance. Atlassian Cloud sites are not affected by this issue. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

Recommendations Immediately patch to a fixed version. For Confluence Data Center and Server, update to version 7.19.17 (LTS), 8.4.5, or 8.5.4 (LTS). For Confluence Data Center, update to version 8.6.2 or later, or 8.7.1 or later.

Correção

RCE

Special Elements Injection

Enumeração de Fraquezas

CWE-74

CWE-159

CWE-138

Identificadores relacionados

BDU:2023-08564

CVE-2023-22522

Produtos afetados

Confluence

Referências · 26

• https://twitter.com/CyberGovAU/status/1732644635950891092 · Publicação no Twitter
• https://jira.atlassian.com/browse/CONFSERVER-93502 · Aviso do Fabricante
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1319570362 · Aviso do Fabricante
• https://t.me/true_secator/5170 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22522 · Aviso do Fabricante
• https://vuldb.com/?id.247033 · Nota
• https://twitter.com/jbhall56/status/1732748698860331170 · Publicação no Twitter
• https://twitter.com/fletch_ai/status/1732627774383292422 · Publicação no Twitter
• https://t.me/netlas/123 · Publicação no Telegram
• https://twitter.com/ervik/status/1733046271424733228 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1732267367671984508 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-22522 · Nota de Segurança
• https://twitter.com/qualys/status/1732865392014417967 · Publicação no Twitter
• https://twitter.com/melihkaanyldz/status/1742267803887865975 · Publicação no Twitter
• https://t.me/cvenotify/62623 · Publicação no Telegram