Atlassian Releases Patches for Critical Flaws in Confluence and Bamboo

Atlassian has unveiled updates to handle a few security flaws impacting its Confluence Server, Details Heart, and Bamboo Data Heart items that, if efficiently exploited, could result in distant code execution on susceptible methods.

The listing of the flaws is under –

• CVE-2023-22505 (CVSS score: 8.) – RCE (Distant Code Execution) in Confluence Details Centre and Server (Mounted in variations 8.3.2 and 8.4.)
• CVE-2023-22508 (CVSS rating: 8.5) – RCE (Distant Code Execution) in Confluence Information Center and Server (Preset in variations 7.19.8 and 8.2.)
• CVE-2023-22506 (CVSS score: 7.5) – Injection, RCE (Distant Code Execution) in Bamboo (Mounted in versions 9.2.3 and 9.3.1)

CVE-2023-22505 and CVE-2023-22508 make it possible for an “authenticated attacker to execute arbitrary code which has large effects to confidentiality, substantial affect to integrity, superior influence to availability, and no consumer conversation,” the enterprise claimed.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Even though the very first bug was introduced in version 8.., CVE-2023-22508 was introduced in variation 7.4. of the software program.

Approaching WEBINARShield Towards Insider Threats: Grasp SaaS Security Posture Management

Apprehensive about insider threats? We have obtained you coated! Join this webinar to explore useful approaches and the secrets and techniques of proactive security with SaaS Security Posture Management.

Sign up for Right now

CVE-2023-22506, launched in variation 8.. of Bamboo Data Center, permits an “authenticated attacker to modify the actions taken by a technique phone and execute arbitrary code which has large effect to confidentiality, substantial effects to integrity, significant impression to availability, and no person interaction,” according to Atlassian.

Previously this January, the Australian organization shipped patches to solve a critical security flaw in Jira Provider Administration Server and Knowledge Center that could be abused by an attacker to move off as yet another consumer and get unauthorized obtain to vulnerable scenarios (CVE-2023-22501, CVSS score: 9.4).

Months afterwards, it also rolled out fixes for two critical overflow flaws in Git (CVE-2022-41903 and CVE-2022-23531) impacting Bitbucket Server and Information Middle, Bamboo Server and Knowledge Middle, Fisheye, Crucible, and Sourcetree.

With security vulnerabilities in Atlassian servers turning out to be attack magnets in the latest decades, it truly is encouraged that end users transfer swiftly to utilize the patches to safeguard against potential threats.

Located this post attention-grabbing? Adhere to us on Twitter  and LinkedIn to study extra distinctive material we submit.