101010.pl

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:Security Bulletin: Atlassian June 2024Date: June 18, 2024 CVE: CVE-2024-22257 Vulnerability Type: Improper Authorization CWE: [[CWE-284]], [[CWE-918]], [[CWE-400]] Sources: <a href="https://confluence.atlassian.com/security/security-bulletin-june-18-2024-1409286211.html" rel="nofollow noopener" target="_blank">Atlassian Documentation</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-22257" rel="nofollow noopener" target="_blank">NVD</a>SynopsisAtlassian has released a security bulletin addressing multiple high-severity vulnerabilities in its products. These vulnerabilities, discovered through the company's Bug Bounty program and third-party scans, have been fixed in recent versions.Issue SummaryNine high-severity vulnerabilities affecting various Atlassian products were disclosed. These vulnerabilities include issues such as improper authorization and server-side request forgery (SSRF) in dependencies like org.springframework.security:spring-security-core and org.springframework:spring-web. Confluence, Jira, and Fisheye/Crucible are among the affected products.Technical Key FindingsThe vulnerabilities primarily involve improper authorization and SSRF, which allow attackers to exploit insufficient validation of user inputs. For instance, CVE-2024-22257 involves improper authorization due to flaws in the org.springframework.security:spring-security-core dependency, potentially leading to unauthorized access.Vulnerable Products<ul><li>Confluence Data Center and Server: Versions 8.9.0 to 8.9.2, 8.8.0 to 8.8.1, 8.7.1 to 8.7.2, among others.</li><li>Fisheye/Crucible: Versions 4.8.10 to 4.8.14.</li><li>Jira Data Center and Server: Versions 9.12.0 to 9.12.7 (LTS), 9.4.0 to 9.4.20 (LTS).</li><li>Jira Service Management: Versions 5.15.2, 5.12.0 to 5.12.7 (LTS).</li></ul>Impact AssessmentExploiting these vulnerabilities could lead to unauthorized access, denial of service (DoS), or information disclosure, significantly impacting the confidentiality, integrity, and availability of the affected systems.Patches or WorkaroundPatches have been released for the affected products. Users are advised to update to the latest versions or apply the recommended fixed versions listed in the bulletin. No temporary mitigations are provided; hence, immediate patching is crucial.Tags<a href="https://infosec.exchange/tags/Atlassian" class="mention hashtag" rel="nofollow noopener" target="_blank">#Atlassian</a> <a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a>-2024-22257 <a href="https://infosec.exchange/tags/ImproperAuthorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#ImproperAuthorization</a> <a href="https://infosec.exchange/tags/SSRF" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSRF</a> <a href="https://infosec.exchange/tags/DoS" class="mention hashtag" rel="nofollow noopener" target="_blank">#DoS</a> <a href="https://infosec.exchange/tags/Confluence" class="mention hashtag" rel="nofollow noopener" target="_blank">#Confluence</a> <a href="https://infosec.exchange/tags/Jira" class="mention hashtag" rel="nofollow noopener" target="_blank">#Jira</a> <a href="https://infosec.exchange/tags/SecurityBulletin" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityBulletin</a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a>

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:"🚨 <a href="https://infosec.exchange/tags/SecurityBulletin" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityBulletin</a>: IBM Db2 Vulnerabilities Alert! 🚨"IBM has released a security bulletin detailing multiple vulnerabilities in IBM Db2, which is shipped with IBM WebSphere Remote Server. These vulnerabilities range from denial of service attacks to information disclosure vulnerabilities. Some of the notable CVEs include:<ul><li>CVE-2023-39976: A vulnerability in libqb affecting IBM® Db2® High-Availability deployments using Pacemaker.</li><li>CVE-2023-40373: IBM® Db2® is vulnerable to denial of service with a specially crafted query containing common table expressions.</li><li>CVE-2023-40372: IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement using External Tables.</li><li>CVE-2023-33850: IBM® Db2® has an information disclosure vulnerability due to the consumed GSKit library.</li></ul>IBM urges users to address these vulnerabilities by upgrading the affected products. For a detailed breakdown and remediation steps, refer to the official <a href="https://www.ibm.com/support/pages/node/7062492" rel="nofollow noopener" target="_blank">IBM Security Bulletin</a>.Tags: <a href="https://infosec.exchange/tags/IBM" class="mention hashtag" rel="nofollow noopener" target="_blank">#IBM</a> <a href="https://infosec.exchange/tags/Db2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Db2</a> <a href="https://infosec.exchange/tags/WebSphere" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebSphere</a> <a href="https://infosec.exchange/tags/SecurityBulletin" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityBulletin</a> <a href="https://infosec.exchange/tags/Vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerabilities</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/DenialOfService" class="mention hashtag" rel="nofollow noopener" target="_blank">#DenialOfService</a> <a href="https://infosec.exchange/tags/InformationDisclosure" class="mention hashtag" rel="nofollow noopener" target="_blank">#InformationDisclosure</a> 🛡️🔍🚀

Recent searches

Search options

Administered by:

Server stats:

#securitybulletin