PT-2023-7455 · Atlassian · Assets Discovery

Bug Bounty + 1 · Published 2023-12-04 · Updated 2023-12-20 · CVE-2023-22523

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atlassian Assets Discovery (affected versions not specified)

Description This issue allows an attacker to perform privileged Remote Code Execution (RCE) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application and the Assets Discovery agent. It is related to insufficient authentication data verification. Exploitation may allow a remote attacker to execute arbitrary code by spoofing the application server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2023-08497

CVE-2023-22523

Affected Products

Assets Discovery

References · 19

• https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22523 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08497 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-22523 · Security Note
• https://jira.atlassian.com/browse/JSDSERVER-14925 · Vendor Advisory
• https://twitter.com/CyberGovAU/status/1732644635950891092 · Twitter Post
• https://t.me/true_secator/5170 · Telegram Post
• https://t.me/cvenotify/62505 · Telegram Post
• https://twitter.com/ervik/status/1733046271424733228 · Twitter Post
• https://t.me/cvenotify/62471 · Telegram Post
• https://twitter.com/qualys/status/1732865392014417967 · Twitter Post
• https://t.me/pentestbacklog/238 · Telegram Post
• https://t.me/cvenotify/63195 · Telegram Post
• https://twitter.com/CyberxtronTech/status/1733523125290389522 · Twitter Post
• https://t.me/cvenotify/62529 · Telegram Post