Pierluigi Paganini
July 25, 2023
Atlassian has addressed three critical and high severity vulnerabilities impacting the Confluence Server, Data Center, and Bamboo Data Center products. Successful exploitation of the vulnerabilities could result in remote code execution on vulnerable systems.
According to the advisory, the vulnerabilities were reported to the company via its bug bounty and pen-testing processes, as well as 3rd party library scans.
Below is the list of flaws addressed by the company:
.
| Released Security Vulnerabilities | |||||
|---|---|---|---|---|---|
| Summary | Severity | CVSS Score | CVE ID | View | Public Date |
| RCE (Remote Code Execution) in Confluence Data Center & Server | High | 8 | CVE-2023-22505 | View Ticket | Jul 18, 2023 |
| RCE (Remote Code Execution) in Confluence Data Center & Server | High | 8.5 | CVE-2023-22508 | View Ticket | Jul 18, 2023 |
| Injection, RCE (Remote Code Execution) in Bamboo | High | 7.5 | CVE-2023-22506 | View Ticket | Jul 18, 2023 |
The most severe flaw, tracked as CVE-2023-22508 (CVSS score: 8.5), is a Remote Code Execution that impacts the Confluence Data Center and Server. The flaw CVE-2023-22508 was introduced in version 7.4.0 of Confluence Data Center & Server.
The second flaw addressed by the company is a high severity Injection and RCE (Remote Code Execution) vulnerability, tracked as CVE-2023-22506 (CVSS Score 7.5). The flaw was introduced in version 8.0.0 of Bamboo Data Center. An authenticated attacker can trigger the issue to modify the actions taken by a system call and execute arbitrary code without any user interaction.
Weeks later, it also rolled out fixes for two critical overflow flaws in Git (CVE-2022-41903 and CVE-2022-23531) affecting Bitbucket Server and Data Center, Bamboo Server and Data Center, Fisheye, Crucible, and Sourcetree.
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, Atlassian)
