bitvoodoo Advisories
Space shortcuts
Space Tools
bitvoodoo Advisories BVADVIS

Versions Compared

Old Version 7

changes.mady.by.user Miro Meier

Saved on

compared with

New Version 8

changes.mady.by.user Alexandre Allart

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Warning

This is a public space:

For the draft, please restrict the page during creation and
remove this warning when page is published



German

Inhalte


French

Contenu


English

Contents

Table of Contents


Page properties


Date

 

Product

Confluence Data Center and Server

(info) Atlassian Cloud Instances are not affected

VulnerabilityCritical
CVECVE-2023-22515
Official link(warning) tbd




French
Privilege Escalation Vulnerability in

Vulnérabilité d'escalade de privilèges dans Confluence Data Center

and

et Server - CVE-2023-22515

Dear customer,

Chère cliente, cher client,

Le 4 octobre 2023 à 15h, Atlassian a publié un avis de sécurité pour On the 4th of October 2023 6AM PDT, Atlassian issued a Security Advisory for Confluence Server & Confluence Data Center. The Cloud versions of the applications as well as other Atlassian products are not affected.

What you need to know

External attackers are exploiting a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.

Warning

Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously.

Affected Versions

Les versions Cloud des applications ainsi que les autres produits Atlassian ne sont pas concernés.

Ce qu'il faut savoir

Des attaquants externes exploitent une vulnérabilité inconnue jusqu'à présent sur les instances publics Confluence Data Center et Server pour créer un compte administrateur Confluence non autorisé et accéder aux instances Confluence.

Warning

Les instances accessibles publiquement sont particulièrement à risque, car cette vulnérabilité peut être exploitée de manière anonyme.

Versions affectées

Info

Confluence Data Center and et Confluence Server:

  • 8.0.0
  • 8.0.1
  • 8.0.2
  • 8.0.3
  • 8.0.4
  • 8.1.0
  • 8.1.1
  • 8.1.3
  • 8.1.4
  • 8.2.0
  • 8.2.1
  • 8.2.2
  • 8.2.3
  • 8.3.0
  • 8.3.1
  • 8.3.2
  • 8.4.0
  • 8.4.1
  • 8.4.2
  • 8.5.0
  • 8.5.1
What should I do

Que dois-je faire ?

Localtab Group


Localtab
activetrue
titleConfluence Server & Data Center
tabIconbvicon-server

You use Vous utilisez Confluence Server or ou Confluence Data Center 

Update

To address this issuePour remédier à ce problème, Atlassian releaseda mis en place :

  • Les versions Confluence Server and et Data Center versions:

    • 8.3.3 or laterou plus récente
    • 8.4.3 or laterou plus récente
    • 8.5.2 (Long Term Support release) or laterou plus récente

Vous pouvez télécharger les dernières versions à partir des pages de téléchargement pour You can download the latest versions from the download pages for Confluence Server or Confluence Data Center.

Mitigation

Atténuation

L'installation d'une version corrigée de Confluence est le moyen le plus sûr de remédier à la situation (Installing a fixed version of Confluence is the safest way to remediate CVE-2023-22515. If you are unable to immediately upgrade Confluence, then as a temporary workaround we recommend restricting external network access to the affected instance.

Additionally, you can mitigate known attack vectors for this vulnerability by blocking access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.

). Si vous n'êtes pas en mesure de mettre à jour Confluence immédiatement, nous vous recommandons de restreindre l'accès au réseau externe à l'instance affectée.

En outre, vous pouvez atténuer les vecteurs d'attaque connus pour cette vulnérabilité en bloquant l'accès au endpoint /setup/* sur les instances Confluence. Cela est possible au niveau du réseau ou en apportant les modifications suivantes aux fichiers de configuration de Confluence.

  1. Sur chaque nœud, modifiez On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the  et ajoutez le bloc de code suivant (juste avant la balise </web-app> tag at the end of the file à la fin du fichier):

    Code Block
    <security-constraint>
      <web-resource-collection>
        <url-pattern>/setup/*</url-pattern>
			<http-method-omission>*</http-method-omission>
		</web-resource-collection>
      <auth-constraint />
	</security-constraint>


  2. Restart Redémarrer Confluence.

This action will block access to setup pages that are not required for typical Confluence usage, for further details see Cette action bloquera l'accès aux pages de configuration qui ne sont pas nécessaires à l'utilisation classique de Confluence, pour plus de détails voir Atlassians FAQ page.

Threat detection

As well as upgrading to a fixed version, we recommend you check all affected Confluence instances for the following indicators of compromise:

Détection des menaces

Outre la mise à jour vers une version corrigée, nous vous recommandons de vérifier si toutes les instances de Confluence concernées présentent les indicateurs de compromission suivants :

  • Des membres inattendus dans le groupe confluence-administrator

  • Des comptes d'utilisateurs inattendus nouvellement créés 

  • Requêtes

  • unexpected members of the confluence-administrator group

  • unexpected newly created user accounts

  • requests to /setup/*.action in network access logs dans les journaux d'accès au réseau

  • Présence depresence of /setup/setupadministrator.action in an exception message in  dans un message d'exception dans atlassian-confluence-security.log in the Confluence home directory dans le répertoire "home" de Confluence

De plus amples détails sur la manière de procéder sont disponibles sur le site Further details on how to do the above are available on Atlassians FAQ page.


Localtab
titleConfluence Cloud
tabIconbvicon-cloud

You use Vous utilisez Confluence Cloud

Tip

You are not affected by this Security Advisory. No need for actionVous n'êtes pas concerné par cet avis de sécurité. Aucune action n'est nécessaire.



Localtab
titlebitvoodoo Cloud
tabIconbvicon-cloud

You use Vous utilisez Confluence Server or ou Confluence Data Center on servers operated by sur des serveurs exploités par bitvoodoo

Mitigation

Atténuation

Tip

The mitigation has been implemented to secure instances hosted on the bitvoodoo cloud. We have disabled the app on the instances where an update, due to the installed version of Jira, was not Les mesures d'atténuation ont été mises en œuvre pour sécuriser les instances hébergées sur le cloud bitvoodoo. Nous avons désactivé l'application dans les cas où une mise à jour, en raison de la version installée de Jira, n'était pas possible.

Update

LTS Update Package Customers will get contacted to discuss the need of an updateLes clients du Package de mise à jour LTS seront contactés pour discuter de la nécessité d'une mise à jour.


Support

If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via supportSi vous avez encore des questions ou des inquiétudes concernant cet avis, veuillez contacter le support de bitvoodoo via support.bitvoodoo.ch.


German

Privilege Escalation Vulnerability in Confluence Data Center and Server - CVE-2023-22515

Dear customer,

On the 4th of October 2023 6AM PDT, Atlassian issued a Security Advisory for Confluence Server & Confluence Data Center. The Cloud versions of the applications as well as other Atlassian products are not affected.

What you need to know

External attackers are exploiting a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.

Warning

Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously.

Affected Versions

Sehr geehrte Kunden,

Am 04. Oktober 2023 6:00 Uhr PDT hat Atlassian ein Security Advisory für Confluence Server & Data Center veröffentlicht. Die Cloud-Versionen der Anwendungen sowie andere Atlassian-Produkte sind nicht betroffen.

Was Sie wissen müssen

Externe Angreifer nutzen eine bisher unbekannte Schwachstelle in öffentlich zugänglichen Confluence Data Center- und Server-Instanzen aus, um nicht autorisierte Confluence-Administratorkonten zu erstellen und auf Confluence-Instanzen zuzugreifen.

Warning

Instanzen im öffentlichen Internet sind besonders gefährdet, da diese Sicherheitslücke anonym ausgenutzt werden kann.

Betroffene Versionen

Info

Confluence Data Center and und Confluence Server:

  • 8.0.0
  • 8.0.1
  • 8.0.2
  • 8.0.3
  • 8.0.4
  • 8.1.0
  • 8.1.1
  • 8.1.3
  • 8.1.4
  • 8.2.0
  • 8.2.1
  • 8.2.2
  • 8.2.3
  • 8.3.0
  • 8.3.1
  • 8.3.2
  • 8.4.0
  • 8.4.1
  • 8.4.2
  • 8.5.0
  • 8.5.1
What should I do

Was soll ich tun?

Localtab Group


Localtab
activetrue
titleConfluence Server & Data Center
tabIconbvicon-server

You use Confluence Server or Confluence Data Center 

Update

To address this issue, Atlassian released:

  • Confluence Server and Data Center versions:

    • 8.3.3 or later
    • 8.4.3 or later
    • 8.5.2 (Long Term Support release) or later

You can download the latest versions from the download pages for Confluence Server or Confluence Data Center.

Mitigation

Installing a fixed version of Confluence is the safest way to remediate CVE-2023-22515. If you are unable to immediately upgrade Confluence, then as a temporary workaround we recommend restricting external network access to the affected instance.

Additionally, you can mitigate known attack vectors for this vulnerability by blocking access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.

  1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):

    Code Block
    <security-constraint>
      <web-resource-collection>
        <url-pattern>/setup/*</url-pattern>
			<http-method-omission>*</http-method-omission>
		</web-resource-collection>
      <auth-constraint />
	</security-constraint>


  2. Restart Confluence.

This action will block access to setup pages that are not required for typical Confluence usage, for further details see Atlassians FAQ page.

Threat detection

As well as upgrading to a fixed version, we recommend you check all affected Confluence instances for the following indicators of compromise:

  • unexpected members of the confluence-administrator group

  • unexpected newly created user accounts

  • requests to /setup/*.action in network access logs

  • presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

Further details on how to do the above are available on Atlassians FAQ page.


Localtab
titleConfluence Cloud
tabIconbvicon-cloud

You use Confluence Cloud

Tip

You are not affected by this Security Advisory. No need for action.



Localtab
titlebitvoodoo Cloud
tabIconbvicon-cloud

You use Confluence Server or Confluence Data Center on servers operated by bitvoodoo

Mitigation

Tip

The mitigation has been implemented to secure instances hosted on the bitvoodoo cloud. We have disabled the app on the instances where an update, due to the installed version of Jira, was not possible.

Update

LTS Update Package Customers will get contacted to discuss the need of an update.


Support

If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch.


English

Privilege Escalation Vulnerability in Confluence Data Center and Server - CVE-2023-22515

Dear customer,

On the 4th of October 2023 6AM PDT, Atlassian issued a Security Advisory for Confluence Server & Confluence Data Center. The Cloud versions of the applications as well as other Atlassian products are not affected.

What you need to know

External attackers are exploiting a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.

Warning

Instances on the public internet are particularly at risk, as this vulnerability is exploitable anonymously.

Affected Versions

Info

Confluence Data Center and Confluence Server:

  • 8.0.0
  • 8.0.1
  • 8.0.2
  • 8.0.3
  • 8.0.4
  • 8.1.0
  • 8.1.1
  • 8.1.3
  • 8.1.4
  • 8.2.0
  • 8.2.1
  • 8.2.2
  • 8.2.3
  • 8.3.0
  • 8.3.1
  • 8.3.2
  • 8.4.0
  • 8.4.1
  • 8.4.2
  • 8.5.0
  • 8.5.1

What should I do?

Localtab Group


Localtab
activetrue
titleConfluence Server & Data Center
tabIconbvicon-server

You use Confluence Server or Confluence Data Center 

Update

To address this issue, Atlassian released:

  • Confluence Server and Data Center versions:

    • 8.3.3 or later
    • 8.4.3 or later
    • 8.5.2 (Long Term Support release) or later

You can download the latest versions from the download pages for Confluence Server or Confluence Data Center.

Mitigation

Installing a fixed version of Confluence is the safest way to remediate CVE-2023-22515. If you are unable to immediately upgrade Confluence, then as a temporary workaround we recommend restricting external network access to the affected instance.

Additionally, you can mitigate known attack vectors for this vulnerability by blocking access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.

  1. On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):

    Code Block
    <security-constraint>
      <web-resource-collection>
        <url-pattern>/setup/*</url-pattern>
			<http-method-omission>*</http-method-omission>
		</web-resource-collection>
      <auth-constraint />
	</security-constraint>


  2. Restart Confluence.

This action will block access to setup pages that are not required for typical Confluence usage, for further details see Atlassians FAQ page.

Threat detection

As well as upgrading to a fixed version, we recommend you check all affected Confluence instances for the following indicators of compromise:

  • unexpected members of the confluence-administrator group

  • unexpected newly created user accounts

  • requests to /setup/*.action in network access logs

  • presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

Further details on how to do the above are available on Atlassians FAQ page.


Localtab
titleConfluence Cloud
tabIconbvicon-cloud

You use Confluence Cloud

Tip

You are not affected by this Security Advisory. No need for action.



Localtab
titlebitvoodoo Cloud
tabIconbvicon-cloud

You use Confluence Server or Confluence Data Center on servers operated by bitvoodoo

Mitigation

Tip

The mitigation has been implemented to secure instances hosted on the bitvoodoo cloud. We have disabled the app on the instances where an update, due to the installed version of Jira, was not possible.

Update

LTS Update Package Customers will get contacted to discuss the need of an update.


Support

If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch.


bitvoodoo Advisories BVADVIS