2024-009: Critical and High Vulnerabilities in Atlassian Products

2024-009: Critical and High Vulnerabilities in Atlassian Products ↗ source

January 17, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-009/

Summary

The editor also released a security advisory addressing 28 high-severity vulnerabilities which have been fixed in new versions of Atlassian products [2]. The critical vulnerability CVE-2023-22527 , with a CVSS score of 10, is due to a template injection vulnerability on out-of-date versions of Confluence Data Center and Server that allows an unauthenticated attacker to achieve RCE on an affected version [1]. Among the other 28 vulnerabilities [2], 6 of them could lead to Remote Code Execution on The vulnerability CVE-2023-22527 affects out-of-date Confluence Data Center and Server 8 versions released before Dec. 5, 2023 (i.e., Confluence Data Center and Server versions 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3 ), as well as 8.4.5 which no longer receives backported fixes in accordance with Atlassian’s Security Bug Fix Policy [1].

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2023-22527	10.0 Critical	Atlassian Confluence Data Center and Server Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Atlassian 13 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.