ZeroFox Intelligence Flash Report - Disclosure of Critical Atlassian Confluence Vulnerability

Product Serial: F-2024-01-17a

TLP:CLEAR

In this flash report, ZeroFox researchers provide updates on a critical Atlassian Confluence vulnerability which involves a critical remote code execution flaw in Confluence Data Center and Confluence Server.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report [here] https://zf-dashboard-media.s3.amazonaws.com/intel/24c1ba52-6248-48d3-8486-339f40c9e019)

Key Findings

On January 16, 2024, Atlassian issued a security update to patch CVE-2023-22527, a critical remote code execution flaw in Confluence Data Center and Confluence Server. The exploit impacts all Confluence Data Center and Server 8 versions released prior to December 5, 2023.
Atlassian’s security update is part of a wider bulletin affecting a total of 29 vulnerabilities across several of its products.
Atlassian Confluence exploits have a history of being widely-exploited by threat actors. While no proof of active exploitation in the wild has yet been identified, threat actors will very likely leverage this exploit against unpatched networks in the short term.
ZeroFox urges users to ensure networks are patched with the latest Atlassian software updates.