Atlassian addressed four new RCE flaws in its products
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1471 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization | 9.8 | 100% | PoC ×3 | |
| CVE-2023-22515 | Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2023-22518 | Improper Authorization in Atlassian Confluence Data Center and Server | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-22522 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page | 8.8 | 13% | ||
| CVE-2023-22523 | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed | 8.8 | 11% | ||
| CVE-2023-22524 | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability | 9.8 | 25% |
From the original article
2 min read at securityaffairs.comAustralian Software giant Atlassian addressed four critical Remote Code Execution (RCE) vulnerabilities in its products. Atlassian released security patches to address four critical remote code execution vulnerabilities in its products. Below is the list of vulnerabilities addressed by the vendor:
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.