Atlassian patches several critical vulnerabilities

Atlassian has issued patches for a variety of critical vulnerabilities, leading with a fix for CVE-2023-22522, a template injection vulnerability in Confluence Data Centre and Confluence Server.

The vulnerability allows an attacker to “inject unsafe user input into a Confluence page,” the advisory explained, giving the attacker remote code execution (RCE) on an affected instance.

It affects all versions of Confluence Data Centre and Server after version 4.0.0, and users need to upgrade to a fixed version.

Elsewhere, the vendor stated that CVE-2023-22524 is an RCE in the Atlassian Companion App for MacOS.

The advisory explained that an attacker could use WebSockets “to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow the execution of code.”

CVE-2023-22523 is a critical-rated bug in Asset Discovery in Jira Service Management Cloud, Server, and Data Centre.

“The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent”, the advisory said, giving the attacker privileged RCE.

Finally, CVE-2022-1471 is an RCE deserialisation bug in the SnakeYAML library, which is used in multiple Atlassian products.

These include Automation for Jira, and various BitBucket, Confluence, and Jira configurations. Patches are available for affected versions.