Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution

Atlassian has launched software program program fixes to take care of four critical flaws in its software program program that, if effectively exploited, could result in distant code execution.

The report of vulnerabilities is beneath –

• CVE-2022-1471 (CVSS ranking: 9.8) – Deserialization vulnerability in SnakeYAML library that will end in distant code execution in a lot of merchandise
• CVE-2023-22522 (CVSS ranking: 9.0) – Distant code execution vulnerability in Confluence Data Coronary heart and Confluence Server (impacts all variations along with and after 4.0.0)
• CVE-2023-22523 (CVSS ranking: 9.8) – Distant code execution vulnerability in Property Discovery for Jira Service Administration Cloud, Server, and Data Coronary heart (impacts all variations as a lot as nevertheless not along with 3.2.0-cloud / 6.2.0 info coronary heart and server)
• CVE-2023-22524 (CVSS ranking: 9.6) – Distant code execution vulnerability in Atlassian Companion app for macOS (impacts all variations as a lot as nevertheless not along with 2.0.0)

Atlassian described CVE-2023-22522 as a template injection flaw that allows an authenticated attacker, along with one with anonymous entry, to inject unsafe particular person enter proper right into a Confluence net web page, resulting in code execution.

The Property Discovery flaw permits an attacker to hold out privileged distant code execution on machines with the Property Discovery agent put in, whereas CVE-2023-22524 could enable an attacker to realize code execution through the use of WebSockets to bypass Atlassian Companion’s blocklist and macOS Gatekeeper protections.

The advisory comes nearly a month after the Australian software program program agency revealed all variations of its Bamboo Data Coronary heart and Server merchandise are impacted by an actively exploited essential security flaw in Apache ActiveMQ (CVE-2023-46604, CVSS ranking: 10.0). Fixes have been launched in variations 9.2.7, 9.3.5, and 9.4.1 or later.

With Atlassian merchandise turning into worthwhile assault vectors currently, this can be very actually helpful that prospects switch shortly to interchange affected installations to a patched mannequin.

Thanks for being a valued member of the Nirantara household! We admire your continued assist and belief in our apps.

If you have not already, we encourage you to obtain and expertise these unbelievable apps. Keep linked, knowledgeable, trendy, and discover wonderful journey gives with the Nirantara household!