More than 600 IP addresses are launching thousands of exploit attempts against CVE-2023-22527 - a critical bug in out-of-date versions of Atlassian Confluence Data Center and Server - according to non-profit security org Shadowserver.
Atlassian disclosed the flaw, a template injection flaw that can allow unauthenticated remote code execution attacks, last week.
The CVE scored a CVSS rating of 10 out of 10, and it affects Confluence Data Center and Server 8 versions released before December 5, 2023 and versions up to 8.4.5.
As of Sunday more than 11,000 instances remain exposed on the internet, and criminals are pounding them with RCE attempts.
In an Xeet on Monday, Shadowserver reported seeing more than 39,000 such attempts since January 19.
Internet scanning outfit GreyNoise also reported RCE exploit attempts.
Atlassian hasn't updated its CVE-2023-22527 security advisory to indicate any instances of Confluence Server being under active exploitation.
The issue has already been corrected in a previous release of Confluence Server and Data Center.
We continue to strongly recommend that all customers upgrade to the latest patched versions as per our Critical Security Advisory.
These include patching, plus threat hunting, reviewing logs, monitoring, and auditing the potentially affected systems.
This latest perfect-10-rated CVE follows a string of critical flaws that have plagued the Australian software developer over recent months.
These include four critical bugs, rated 9.0 or higher, that Atlassian alerted customers about last month, via email.
The warning proved ineffective because the email's links weren't live when the message was originally sent.
There was an improper authorization vulnerability in Confluence Data Center and Server that initially earned a CVSS score of 9.1 before being upgraded to a 10 after miscreants began exploiting that vulnerability.
Atlassian security may soon become even more challenged: on February 15th the Aussie software company ends support for its Server products, with vastly more expensive Datacenter products or a cloud migration the alternatives.
An Atlassian partner recently told The Register that forty percent of its clientele intends to continue using the unsupported products despite Atlassian insisting it won't provide patches.
This Cyber News was published on go.theregister.com. Publication date: Tue, 23 Jan 2024 00:13:04 +0000