Critical Atlassian Bug Exploited in Ransomware Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-22515 | Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server | 9.8 | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.176.179.41 | ownload a malicious payload hosted at 193.43.72[.]11 and/or 193.176.179[.]41, which, if successful, led to single-system Cerber ransom |
| ipv4 | 193.43.72.11 | command execution to download a malicious payload hosted at 193.43.72[.]11 and/or 193.176.179[.]41, which, if successful, led to sin |
From the original article
1 min read at infosecurity-magazine.com
Security researchers have warned that threat actors are already exploiting a critical Atlassian vulnerability for which a public exploit was found just last week. The Australian software developer said last Thursday that it had discovered “publicly posted critical information” about CVE-2023-22518, which has a CVSS score of 9. 1 and impacts all versions of Atlassian Confluence Data Center and Server.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.