{"id":1200205,"date":"2023-11-06T18:40:20","date_gmt":"2023-11-06T23:40:20","guid":{"rendered":"https:\/\/www.prime-wow.com\/?p=1200205"},"modified":"2023-11-06T18:40:20","modified_gmt":"2023-11-06T23:40:20","slug":"critical-vulnerability-in-atlassian-confluence-server-is-under-mass-exploitation","status":"publish","type":"post","link":"https:\/\/www.prime-wow.com\/?p=1200205","title":{"rendered":"Critical vulnerability in Atlassian Confluence server is under \u201cmass exploitation\u201d"},"content":{"rendered":"
\n
\n \"Critical<\/p>\n

Enlarge<\/a> <\/p>\n<\/figure>\n

<\/div>\n

A critical vulnerability in Atlassian\u2019s Confluence enterprise server app that allows for malicious commands and reset servers is under active exploitation by threat actors in attacks that install ransomware, researchers said.<\/p>\n

\u201cWidespread exploitation of the CVE-2023-22518 authentication bypass vulnerability in Atlassian Confluence Server has begun, posing a risk of significant data loss,\u201d Glenn Thorpe, senior director of security research and detection engineering at security firm GreyNoise, wrote on Mastodon<\/a> on Sunday. \u201cSo far, the attacking IPs all include Ukraine in their target.\u201d<\/p>\n

\n
<\/div>\n

He pointed to a page<\/a> showing that between 12 am and 8 am on Sunday UTC (around 5 pm Saturday to 1 am Sunday Pacific Time), three different IP addresses began exploiting the critical vulnerability, which allows attackers to restore a database and execute malicious commands. The IPs have since stopped those attacks, but he said he suspected the exploits are continuing.<\/p>\n<\/div>\n

Read 11 remaining paragraphs<\/a> | Comments<\/a><\/p>\n


\n
\nSource: Ars Technica – Critical vulnerability in Atlassian Confluence server is under \u201cmass exploitation\u201d<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Enlarge A critical vulnerability in Atlassian\u2019s Confluence enterprise server app that allows for malicious commands and reset servers is under active exploitation by threat actors in attacks that install ransomware, researchers said. \u201cWidespread exploitation of the CVE-2023-22518 authentication bypass vulnerability … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1200206,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,110],"tags":[73],"class_list":["post-1200205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ars-technica","category-unfiltered-rss","tag-ars-technica"],"_links":{"self":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts\/1200205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1200205"}],"version-history":[{"count":0,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts\/1200205\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/media\/1200206"}],"wp:attachment":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1200205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1200205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1200205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}