Security News > 2023 > July > Atlassian Releases Patches for Critical Flaws in Confluence and Bamboo

Atlassian has released updates to address three security flaws impacting its Confluence Server, Data Center, and Bamboo Data Center products that, if successfully exploited, could result in remote code execution on susceptible systems.

CVE-2023-22505 and CVE-2023-22508 allow an "Authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction," the company said.

CVE-2023-22506, introduced in version 8.0.0 of Bamboo Data Center, permits an "Authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction," according to Atlassian.

Earlier this January, the Australian company shipped patches to resolve a critical security flaw in Jira Service Management Server and Data Center that could be abused by an attacker to pass off as another user and gain unauthorized access to susceptible instances.

Weeks later, it also rolled out fixes for two critical overflow flaws in Git affecting Bitbucket Server and Data Center, Bamboo Server and Data Center, Fisheye, Crucible, and Sourcetree.

With security vulnerabilities in Atlassian servers becoming attack magnets in recent years, it's recommended that users move quickly to apply the patches to safeguard against potential threats.

News URL

https://thehackernews.com/2023/07/atlassian-releases-patches-for-critical.html