Lebanese Cedar APT group broke into telco and ISPs worldwide

CVE-2012-3152 is an unspecified remote vulnerability in the Reports Developer component of Oracle Fusion Middleware that allows attackers to affect the confidentiality and integrity of affected systems. An attacker who can reach the reporting service over the network can send crafted requests to read sensitive data or tamper with information handled by that component; the precise trigger mechanism and authentication requirements are not detailed in available data. Any organization running Oracle Fusion Middleware with the Reports Developer component deployed is potentially affected, with telecoms, ISPs, and hosting providers among the environments observed to be targeted. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and is associated with the Lebanese Cedar APT's intrusions into telecoms, ISPs, and hosting firms worldwide. EPSS rates the 30-day exploitation probability at 98.8% (100th percentile), making prompt patching a high priority.

Do: Apply vendor-supplied updates to Oracle Fusion Middleware per CISA's required action (apply updates per vendor instructions). Inventory your environment to determine whether the Reports Developer/Oracle Reports component is deployed and whether it is internet-exposed, and restrict network access to it where patching is not immediately possible. Because the flaw has been used in the wild by the Lebanese Cedar APT, especially in telecom, ISP, and hosting environments, also hunt for signs of compromise such as unexpected processes, webshells, or unusual outbound connections.

Atlassian Jira Server and Data Center contain a server-side template injection (CWE-74) in the ContactAdministrators and SendBulkMail actions, rated critical at CVSS 9.8. The flaw is triggered by sending crafted, template-syntax input to these mail-related actions over the network; because the vulnerability requires no authentication or user interaction per the CVSS vector, any attacker who can reach the Jira web interface can trigger it. Successful exploitation yields unauthenticated remote code execution on the server hosting Jira, with high impact on confidentiality, integrity, and availability. Organizations running any Jira Server or Data Center release in the 4.4–7.6, 7.7–7.13, 8.0, 8.1, or 8.2 lines prior to the listed fixed versions are affected, and the exposure is concentrated among instances reachable from the internet. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-07 with a required action to apply vendor updates, and EPSS places it in the 100th percentile (~84.6% probability of exploitation within 30 days).

Do: Apply the vendor updates per Atlassian/CISA instructions — upgrade to Jira 7.6.14, 7.13.5, 8.0.3, 8.1.2, or 8.2.3 (or later) as applicable, since this is a KEV item with a required patching action. As an interim mitigation, disable the 'Allow users to contact administrators' option in Jira's General Configuration to close the ContactAdministrators path and restrict SendBulkMail access, and limit exposure of the Jira web interface to the internet. Review access logs for requests hitting ContactAdministrators/SendBulkMail endpoints containing template injection payloads and hunt for signs of post-exploitation code execution on affected servers.

Atlassian Confluence Server and Data Center contain a server-side template injection flaw (CWE-22) in which attacker-supplied template content is processed by the server, enabling path traversal and ultimately remote code execution. An attacker triggers it by submitting crafted template syntax in a request to a vulnerable instance, and can run arbitrary commands or code on the underlying server. Successful compromise could allow data theft, deployment of webshells, or ransomware; CISA notes known ransomware use of this vulnerability. Organizations running self-hosted Confluence Server or Data Center are affected, particularly instances exposed to the internet. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and EPSS assigns a 99.9% probability of exploitation, placing it in the top percentile.

Do: Apply updates per vendor instructions by upgrading Confluence Server and Data Center to Atlassian's fixed releases, and prioritize internet-facing instances. Until patched, restrict network exposure of Confluence and monitor for signs of compromise such as webshells, unexpected processes, or ransomware activity, since ransomware operators are known to exploit this flaw.