ºÚÁÏÉç

On Tuesday, 5 December 2023, Atlassian published fixes for four critical-severity remote code execution (RCE) vulnerabilities impacting a variety of Atlassian products, including Atlassian Confluence Server and Data Center. The vulnerabilities were discovered by Atlassian as part of a security review and have not been actively exploited by threat actors. Additionally, we have not observed a public proof of concept (PoC) exploit published for any of the vulnerabilities. ?

Threat actors have historically targeted Atlassian vulnerabilities in products impacted by the four vulnerabilities described below to achieve actions on objectives, including and the deployment of ransomware. In November 2023, two recent critical vulnerabilities in Atlassian Confluence Data Center and Server ( and ) were targeted by threat actors for exploitation. Based on these precedents, we assess that threat actors are also likely to attempt exploitation in the near term of one or more of the new vulnerabilities described in this bulletin.??

Vulnerabilities?

?

Recommendations CVE-2023-22523, CVE-2022-1471, CVE-2023-22524, and CVE-2023-22522

Apply the Available Security Patches to Applicable Products

Atlassian released security patches for all impacted products. We recommend applying the latest relevant security patches to impacted products to mitigate the vulnerabilities and prevent potential exploitation.??

Affected and Fixed Products/Versions

Please follow your organisations patching and testing guidelines to avoid operational impact.?

Workarounds

If your organisation is not able to apply the relevant security patches, we recommend following Atlassian¡¯s provided workarounds until able to do so. ?

References

1. ?