Atlassian fixes four critical RCE vulnerabilities, patch quickly!
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1471 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization | 9.8 | 100% | PoC ×3 | |
| CVE-2023-1471 | The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'banner_id' parameter in versions up to, and including, 1.2.5 due to… | 6.5 | <1% | ||
| CVE-2023-22515 | Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-22522 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page | 8.8 | 13% | ||
| CVE-2023-22523 | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed | 8.8 | 11% | ||
| CVE-2023-22524 | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability | 9.8 | 25% |
From the original article
1 min read at helpnetsecurity.com
Atlassian has released security updates for four critical vulnerabilities (CVE-2023-1471, CVE-2023-22522, CVE-2023-22524, CVE-2023-22523) in its various offerings that could be exploited to execute arbitrary code. CVE-2022-1471 is a deserialization flaw in the SnakeYAML library for Java that can lead to remote code execution (RCE).
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.