Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1471 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization | 9.8 | 100% | PoC ×3 | |
| CVE-2023-22522 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page | 8.8 | 13% | ||
| CVE-2023-22523 | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed | 8.8 | 11% | ||
| CVE-2023-22524 | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability | 9.8 | 25% | ||
| CVE-2023-46604 | Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization | 9.8 | 100% | KEVRansomwarePoC | KEV |
From the original article
1 min read at thehackernews.com
Ravie Lakshmanan Dec 06, 2023 Software Security / Vulnerability Atlassian has released software fixes to address four critical flaws in its software that, if successfully exploited, could result in remote code execution. CVE-2022-1471 (CVSS score: 9. 8) - Deserialization vulnerability in SnakeYAML library that can lead to remote code execution in multiple products
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.