Confluence

Atlassian Patches Critical Vulnerability in Bamboo Data Center and Server

by

March 20, 2024 at 10:51AM Atlassian patched 24 vulnerabilities in products including Bamboo, Bitbucket, Confluence, and Jira. The critical-severity bug (CVE-2024-1597) impacts org.postgresql:postgresql, could allow unauthenticated attackers to exploit assets, and affects Bamboo Data Center and Server versions 8.2.1 to 9.5.0. Atlassian also released security updates for Confluence and Jira. Users are advised to update … Read more

Linux Malware Campaign Targets Misconfigured Cloud Servers

by

March 6, 2024 at 11:27AM Cado Security warns of a cryptojacking campaign targeting misconfigured Apache Hadoop, Confluence, Docker, and Redis instances with unique Golang payloads. Attackers use reverse shells, rootkits, and various scripts to exploit vulnerabilities. The extensive attack demonstrates the variety of techniques used to exploit cloud and Linux services, as well as keeping … Read more

Hackers Targeting Critical Atlassian Confluence Vulnerability Days After Disclosure

by

January 22, 2024 at 11:06AM Attempts to exploit a critical Atlassian Confluence vulnerability, CVE-2023-22527, began shortly after its disclosure. Out-of-date versions of Confluence Data Center and Server are affected, allowing unauthenticated attackers to achieve remote code execution. The Shadowserver Foundation reported 40,000 exploitation attempts, highlighting widespread activity and the ongoing risk to vulnerable servers. Based … Read more

Atlassian Warns of Critical RCE Vulnerability in Outdated Confluence Instances

by

January 17, 2024 at 10:30AM Atlassian warns of a critical vulnerability in out-of-date Confluence Data Center and Server versions allowing remote code execution (RCE) without authentication, with a CVE-2023-22527 (CVSS score of 10). This template injection flaw impacts Confluence 8 versions released before Dec. 5, 2023. Atlassian advises immediate patching and recommends updating to the … Read more

Double trouble for VMware and Atlassian admins – there are critical flaws to fix

by

January 16, 2024 at 01:12PM Critical vulnerabilities in Atlassian and VMware products have been revealed. Atlassian’s Confluence Data Center and Server have a flaw allowing remote code execution, and Jira Software Data Center and Server are susceptible to XML external entity attacks. VMware’s Aria Automation faces a missing access control issue, all requiring immediate patching … Read more

Atlassian warns of critical RCE flaw in older Confluence versions

by

January 16, 2024 at 10:23AM Atlassian Confluence Data Center and Server had a critical remote code execution vulnerability (CVE-2023-22527) impacting versions released before December 5, 2023. The flaw allowed unauthenticated attackers to perform remote code execution. Atlassian fixed the vulnerability in later versions and advises users to install the latest version to protect against potential … Read more

Alert: ‘Effluence’ Backdoor Persists Despite Patching Atlassian Confluence Servers

by

November 10, 2023 at 04:03AM Researchers have discovered a stealthy backdoor called Effluence that exploits a security flaw in Atlassian Confluence Data Center and Server. The backdoor allows attackers to move laterally within the network and exfiltrate data. It can be accessed remotely without authenticating to Confluence. The attack chain involves exploiting two critical bugs … Read more

Atlassian Issues Second Warning on Potential Exploitation of Critical Confluence Flaw 

by

November 4, 2023 at 12:30PM Enterprise software maker Atlassian has issued a warning on a critical-severity vulnerability in Confluence Data Center and Confluence Server. The flaw, tracked as CVE-2023-22518, could result in severe data loss due to an improper authorization issue. Atlassian has released patches for the bug and urges organizations to apply them promptly. … Read more

Atlassian CISO Urges Quick Action to Protect Confluence Instances From Critical Vulnerability

by

October 31, 2023 at 02:22PM Software maker Atlassian has issued a warning to all Confluence Data Center and Server customers about a critical vulnerability that could be exploited without authentication. The vulnerability, known as CVE-2023-22518, is an improper authorization bug that affects all Confluence versions. Although no data exfiltration can occur from exploiting the flaw, … Read more

Atlassian warns of critical Confluence flaw leading to data loss

by

October 31, 2023 at 02:06PM Australian software company Atlassian has issued a warning to admins to patch their Internet-exposed Confluence instances due to a critical security flaw. The vulnerability, tracked as CVE-2023-22518, could lead to data loss. While it doesn’t impact confidentiality or allow for data exfiltration, it is necessary to take immediate action to … Read more