PT-2023-32684 · Atlassian · Confluence+2

Camilo Aparecido Ferri Moreira · Published 2023-12-04 · Updated 2025-10-03 · CVE-2023-6481

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions logback versions 1.2.12 through 1.4.13 Bitbucket Data Center and Server versions 7.21.0 through 8.16.0 Confluence Data Center and Server versions 6.0.1 through 8.7.1

Description A serialization vulnerability in the logback receiver component allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. This issue has no impact on confidentiality, no impact on integrity, but a high impact on availability, and requires no user interaction.

Recommendations For logback versions 1.2.12 through 1.4.13, upgrade to a version later than 1.4.13. For Bitbucket Data Center and Server version 7.21, upgrade to a release greater than or equal to 7.21.19. For Bitbucket Data Center and Server version 8.9, upgrade to a release greater than or equal to 8.9.9. For Bitbucket Data Center and Server version 8.13, upgrade to a release greater than or equal to 8.13.5. For Bitbucket Data Center and Server version 8.14, upgrade to a release greater than or equal to 8.14.4. For Bitbucket Data Center version 8.15, upgrade to a release greater than or equal to 8.15.3. For Bitbucket Data Center version 8.16, upgrade to a release greater than or equal to 8.16.2. For Confluence Data Center, upgrade to the latest version, or to one of the specified supported fixed versions. For Confluence Server, upgrade to the latest 8.5.x LTS version, or to one of the specified supported fixed versions.

Fix

Related Identifiers

CVE-2023-6481

GHSA-GM62-RW4G-VRC4

OESA-2023-1946

OPENSUSE-SU-2025:15597-1

Affected Products

Bitbucket

Bitbucket Server

Confluence

References · 26

• https://cve.org/CVERecord?id=CVE-2023-6481 · Security Note
• https://ubuntu.com/security/CVE-2023-6481 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6481 · Security Note
• https://osv.dev/vulnerability/GHSA-gm62-rw4g-vrc4 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6481 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1946 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-6481 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15597-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6378 · Security Note
• https://github.com/qos-ch/logback · Note
• https://github.com/qos-ch/logback/commit/c612b2fa3caf6eef3c75f1cd5859438451d0fd6f · Note
• https://github.com/qos-ch/logback/commit/7018a3609c7bcc9dc7bf5903509901a986e5f578 · Note
• https://suse.com/security/cve/CVE-2023-6378 · Note
• https://jira.atlassian.com/browse/BSERV-19099 · Note