Atlassian has disclosed multiple critical vulnerabilities which effect the following Atlassian software:
CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and Confluence Server
Confluence Data Center
Confluence Server
CVE-2022-1471 - SnakeYAML library RCE Vulnerability In Multiple Products
Automation for Jira app (including Server Lite edition)
Bitbucket Data Center
Bitbucket Server
Confluence Data Center
Confluence Server
Confluence Cloud Migration App
Jira Core Data Center
Jira Core Server
Jira Service Management Data Center
Jira Service Management Server
Jira Software Data Center
Jira Software Server
CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS
Atlassian Companion App for MacOS for
Confluence Server
Confluence Data Center
CVE-2023-22523 - RCE Vulnerability in Assets Discovery
Assets Discovery for
Jira Service Management Cloud
Jira Service Management Server
Jira Service Management Data Center
CVE-2023-22522: Vulnerability in Confluence Data Center and Server
This is a Template Injection vulnerability allowing an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
Atlassian has rated the severity of this vulnerability as critical (9.0). Instances using affected versions, including versions from 4.x.x to 8.5.3 for Confluence Data Center and Server, are susceptible. Immediate action is recommended to safeguard systems.
See the advisory for additional details
CVE-2022-1471 - SnakeYAML library RCE Vulnerability In Multiple Products
The SnakeYAML library RCE Vulnerability (CVE-2022-1471) poses a critical threat to multiple Atlassian Data Center and Server Products, potentially allowing Remote Code Execution (RCE) through a deserialization flaw in the SnakeYAML library for Java. Atlassian Cloud sites remain unaffected by this vulnerability, ensuring secure operations for sites accessed via the atlassian.net domain. The severity rating of 9.8, according to Atlassian's internal assessment, emphasizes the urgency for users to assess and address this vulnerability in their respective IT environments.
See the advisory for additional details.
CVE-2023-22524: RCE Vulnerability in Atlassian Companion App for MacOS
This vulnerability, identified as CVE-2023-22524, affects the Atlassian Companion App for MacOS, specifically versions up to 2.0.0. The flaw involves a Remote Code Execution (RCE) susceptibility, allowing attackers to bypass Atlassian Companion's blocklist using WebSockets, thereby evading MacOS Gatekeeper's security measures.
Atlassian has rated this vulnerability as critical (9.6) due to its potential severity and the potential execution of malicious code. While Atlassian Companion for Windows remains unaffected, all versions of the MacOS app up to 2.0.0 are at risk.
See the advisory for additional details.
CVE-2023-22523 - RCE Vulnerability in Assets Discovery
The vulnerability identified in machines with the Assets Discovery agent installed poses a critical risk, potentially enabling attackers to execute privileged Remote Code Execution (RCE). This security flaw resides between the Assets Discovery application and its associated agent, creating a potential avenue for exploitation. The Assets Discovery tool, available through Atlassian Marketplace, facilitates network scanning and asset management for devices connected to local networks. Atlassian has rated this vulnerability with a severity level of 9.8, emphasizing its critical nature and urging users to evaluate its impact on their IT environments promptly.
