Back
Remote Code Execution in Atlassian products with CVSS score of 10!

Remote Code Execution in Atlassian products with CVSS score of 10!

NEWS Publication date: 2024-01-16

Urgent Security Alert: Critical Vulnerability in Atlassian Products

Our vulnerability database has reported its first CVSS score of 10.0 for 2024. This high score is attributed to the ability of hackers to achieve Remote Code Execution (RCE) on several Atlassian products, including Confluence Data Center and Server. As of the latest updates, there are over 28 vulnerabilities reported, with CVE-2023-22527 having the highest criticality score. Affected products also include BitBucket, Jira, and Bamboo.

Detailed Vulnerability Description

Provided by our in-house Language Learning Model (LLM), the following details outline the critical nature of the threat:

  • Summary of Vulnerability: The primary issue is a template injection that affects older versions of Confluence Data Center and Server. It allows attackers, without authentication, to achieve Remote Code Execution (RCE) on a vulnerable system. Immediate patching is recommended by Atlassian for customers using affected versions.
  • Affected Versions:
    • Confluence Data Center and Server: Versions 8.0.x through 8.5.3.
  • Fixed Versions:
    • Confluence Data Center and Server: Version 8.5.4 (LTS).
    • For Confluence Data Center: Versions 8.6.0 or later, and 8.7.1 or later are secure.
  • Atlassian Cloud sites: This vulnerability does not affect Atlassian Cloud sites hosted on atlassian.net domains.
  • Action Required: Atlassian advises customers to update affected installations to the latest fixed versions. Please note that the listed versions may not encompass all recent patches and might not protect against other non-critical vulnerabilities outlined in Atlassian's January Security Bulletin.
  • CVSS Metrics: The vulnerability is assigned a CVSSv3 base score of 10.0, indicating extreme critical severity. It is network-based, requires low attack complexity, and no privileges. The impact on confidentiality, integrity, and availability is high.

References

For additional details and advisories related to the vulnerability, please consult the following resources: