Atlassian Releases Patches for Critical Flaws in Confluence and Bamboo

Atlassian has launched updates to deal with a few security flaws impacting its Confluence Server, Information Heart, and Bamboo Knowledge Centre items that, if correctly exploited, could outcome in remote code execution on inclined systems.

The checklist of the flaws is underneath –

• CVE-2023-22505 (CVSS score: 8.) – RCE (Distant Code Execution) in Confluence Details Center and Server (Fastened in variations 8.3.2 and 8.4.)
• CVE-2023-22508 (CVSS rating: 8.5) – RCE (Distant Code Execution) in Confluence Facts Heart and Server (Fixed in variations 7.19.8 and 8.2.)
• CVE-2023-22506 (CVSS rating: 7.5) – Injection, RCE (Remote Code Execution) in Bamboo (Set in variations 9.2.3 and 9.3.1)

CVE-2023-22505 and CVE-2023-22508 allow an “authenticated attacker to execute arbitrary code which has significant effect to confidentiality, significant effects to integrity, significant impression to availability, and no person interaction,” the enterprise said.

Although the very first bug was launched in model 8.., CVE-2023-22508 was launched in variation 7.4. of the program.

Approaching WEBINARShield Towards Insider Threats: Grasp SaaS Security Posture Management

Worried about insider threats? We have obtained you lined! Be a part of this webinar to check out useful methods and the insider secrets of proactive security with SaaS Security Posture Management.

Sign up for These days

CVE-2023-22506, introduced in version 8.. of Bamboo Facts Heart, permits an “authenticated attacker to modify the steps taken by a process connect with and execute arbitrary code which has superior effect to confidentiality, substantial effects to integrity, significant effect to availability, and no user conversation,” in accordance to Atlassian.

Previously this January, the Australian firm transported patches to resolve a critical security flaw in Jira Services Management Server and Data Middle that could be abused by an attacker to go off as an additional consumer and acquire unauthorized access to vulnerable situations (CVE-2023-22501, CVSS score: 9.4).

Months afterwards, it also rolled out fixes for two critical overflow flaws in Git (CVE-2022-41903 and CVE-2022-23531) affecting Bitbucket Server and Information Center, Bamboo Server and Information Centre, Fisheye, Crucible, and Sourcetree.

With security vulnerabilities in Atlassian servers turning into attack magnets in modern many years, it’s advised that users shift speedily to implement the patches to safeguard in opposition to possible threats.

Discovered this report fascinating? Comply with us on Twitter  and LinkedIn to browse more unique content we submit.

Some parts of this article are sourced from:
thehackernews.com