RansomwarecriticalExploited in the wild

Confluence and GitLab servers targeted by new ransomware strain

The RecordDec 21, 2022 · 00:00 UTC (Dec 21, 2022)2 min read1 · 1 read

Read at therecord.media

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-26084 CVE-2021-22205

Tags: cve-2021-26084 cve-2021-22205 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-22205	Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)	10.0	100%	KEVRansomwarePoC ×2	Apr 23, 2021 KEV Nov 3, 2021
CVE-2021-26084	Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability	9.8	100%	KEVRansomwarePoC	Aug 30, 2021 KEV Nov 3, 2021

From the original article

2 min read at therecord.media

Over the past few days, a ransomware group has leveraged exploits for recently disclosed vulnerabilities to gain access to unpatched Confluence and GitLab servers, encrypt their files, and then ask server owners for a ransom payment to recover their data.

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.