漏洞标题
N/A
漏洞描述信息
这是一个严重级别的RCE(远程代码执行)漏洞，称为CVE-2023-22508，在 Atlassian Confluence Data Center & Server 7.19.8版本中引入。
这个漏洞(RCE)具有CVSS评分8.5，允许有权限的黑客执行任意代码，这对 confidentiality、Integrity 和 availability 都有非常高的影响，且没有用户交互。
Atlassian建议升级您的实例到最新版本。如果您无法升级到最新版本，请升级到这个修复版本：8.2.0。请查看发布说明([https://confluence.atlassian.com/doc/confluence-release-notes-327.html|https://confluence.atlassian.com/doc/confluence-release-notes-327.html])。您可以从下载中心([https://www.atlassian.com/software/confluence/download-archives|https://www.atlassian.com/software/confluence/download-archives])下载数据中心与服务器的最新版本。
该漏洞是由一个私人用户发现的，并通过我们的漏洞补偿计划报告的。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
对生成代码的控制不恰当(代码注入)
漏洞标题
N/A
漏洞描述信息
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to avoid this bug using the following options: * Upgrade to a Confluence feature release greater than or equal to 8.2.0 (ie: 8.2, 8.2, 8.4, etc...) * Upgrade to a Confluence 7.19 LTS bugfix release greater than or equal to 7.19.8 (ie: 7.19.8, 7.19.9, 7.19.10, 7.19.11, etc...) * Upgrade to a Confluence 7.13 LTS bugfix release greater than or equal to 7.13.20 (Release available early August) See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html ). You can download the latest version of Data Center & Server from the download center (https://www.atlassian.com/software/confluence/download-archives ). If you are unable to upgrade your instance please use the following guide to workaround the issue https://confluence.atlassian.com/confkb/how-to-disable-the-jmx-network-port-for-cve-2023-22508-1267761550.html This vulnerability was discovered by a private user and reported via our Bug Bounty program.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Atlassian Confluence 安全漏洞
漏洞描述信息
Atlassian Confluence是澳大利亚Atlassian公司的一套专业的企业知识管理与协同软件，也可以用于构建企业WiKi。 Atlassian Confluence 8.2.0之前版本存在安全漏洞，该漏洞源于允许经过身份验证的攻击者执行对机密性、完整性、可用性造成严重影响的任意代码。
CVSS信息
N/A
漏洞类别
其他