Atlassian reveals details of further security flaws, so patch now

Red padlock open on electric circuits network dark red background

(Image credit: Shutterstock/Chor muang)

Atlassian has discovered and patched four critical vulnerabilities, and is now urging its users to apply fixes immediately.

All of the flaws have at least a 9.0 severity rating and allow threat actors to run remote code execution (RCE). The first flaw is CVE‑2022‑1471. It carries a 9.8 severity score and affects Automation for Jira app (including Server Lite edition), Bitbucket Data Center, Bitbucket Server, Confluence Data Center, Confluence Server, Confluence Cloud Migration App, Jira Core Data Center, Jira Core Server, Jira Service Management Data Center, Jira Service Management Server, Jira Software Data Center, and Jira Software Server.

The second flaw is CVE‑2023‑22522, with a severity score of 9.0 and affecting Confluence Data Center and Server.

Updating the software

The third flaw is CVE‑2023‑22524, coming in at 9.6 and affecting Atlassian Companion App for MacOS, Jira Service Management Cloud, Data Center and Server, while the fourth and final one is CVE‑2023‑22523 (9.8) affecting the Assets Discovery app for Assets Discovery for Jira Service Management Cloud, Jira Service Management Server and Jira Service Management Data Center.

The fix for all of the above is the same and requires upgrading the software to the latest versions.

Atlassian has had plenty of severe flaws to fix in the past couple of weeks. Less than a month ago, the company released a patch for a high-severity flaw found in Confluence. In early November, it was reported that Atlassian fixed an improper authorization flaw found in all versions of Confluence Data Center and Confluence Server. It’s being tracked as CVE-2023-22518 and carries a severity score of 9.1. Hackers can use it to destroy data found on the affected servers. A few days later, Atlassian warned that the abuse of the flaw was “widespread”. In some cases, researchers found, hackers were using the flaw to drop ransomware on their victims’ endpoints.

Via The Register

More from TechRadar Pro

A critical security flaw in Atlassian Confluence is now being majorly exploited
Here's a list of the best firewalls today
These are the best malware removal tools right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.