Article Details
Scrape Timestamp (UTC): 2023-10-31 05:10:20.312
Source: https://www.theregister.com/2023/10/31/critical_atlassian_confluence_flaw/
Original Article Text
Click to Toggle View
Stop what you’re doing and patch this critical Confluence flaw, warns Atlassian. Risk of ‘significant data loss’ for on-prem customers. Atlassian has told customers they “must take immediate action” to address a newly discovered flaw in its Confluence collaboration tool. An advisory issued on October 31st warns of CVE-2023-22518, described as an “improper authorization vulnerability in Confluence Data Center and Server”, the on-prem versions of Atlassian’s products. All versions of Confluence are susceptible to the bug, which Atlassian rates at 9.1/10 severity on the ten-point Common Vulnerability Scoring System. The Australian vendor hasn’t detailed the nature of the flaw or how it can facilitate data loss. The company has said it’s not seen any exploits. Perhaps explaining the flaw would tip off attackers. The fix is simple: upgrade immediately to version of Confluence that have patched the mysterious flaw. Confluence versions 7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1, or any version later than those releases, will do the job. Before you upgrade, Atlassian suggests disconnecting Confluence instances from the public internet. If that’s not doable, the vendor advises restricting external network access until patches are applied. Users of SaaS-y Confluence in Atlassian’s cloud have nothing to worry about. The flaw is the second urgent Confluence bug to have emerged in October. CVE-2023-22515, announced on October 4th, allowed miscreants to create and abuse Confluence admin accounts. Attackers jumped at the chance to exploit the flaw, leading US authorities to urge rapid patching. The company also reported a critical flaw in its BitBucket product in August 2022. Another factor to consider is that support for the Server version of Confluence will end on February 14th, 2024. When The Register considered that deadline, Atlassian explained it considers itself a cloud-first company and explained that it prioritises the SaaS version of its products. Readers responded with concerns about the cost of migrating to either Atlassian’s Data Center and fears it will receive less attention than the Atlassian cloud. Two critical flaws in a month certainly suggest self-hosted Confluence is a high-maintenance option, and that the A-Cloud is a more comfortable proposition. Atlassian agrees with that position, but also kept its Data Center products alive out of recognition that not every customer is comfortable in the cloud. And today they’re not comfortable outside it, either.
Daily Brief Summary
Atlassian has urged customers to immediately patch a high-severity flaw in its Confluence collaboration tool, citing a risk of "significant data loss".
The Australian vendor issued an advisory for the "improper authorization vulnerability" in Confluence Data Center and Server on October 31, scoring a high 9.1/10 on severity on the Common Vulnerability Scoring System.
Atlassian is yet to provide specific details on the nature of the flaw, but emphasizes that all versions of Confluence could be susceptible to it.
Users are advised to upgrade immediately to a patched version of Confluence and to disconnect their Confluence instances from the public internet before the upgrade.
Those using cloud-based Confluence do not need to worry; the flaw only affects on-prem versions of the product.
This newly discovered flaw comes after an earlier flaw in October, which allowed attackers to create and misuse Confluence admin accounts.
Atlassian's transition to a "cloud-first" company has some users concerned about the attention given to on-prem products, especially with server support for Confluence ending in February 2024. The two critical flaws within a month spark concerns about the maintenance of self-hosted Confluence.