Page 5 - Confluence Server News Today

Attackers almost immediately leapt on a just-disclosed bug, CVE-2022-26138, affecting Atlassian Confluence, which allows remote, unauthenticated actors unfettered access to Confluence data.

CVE-2022-26138 is the second major vulnerability disclosure made for Atlassian’s Confluence collaboration platform in recent months.

A hardcoded password associated with the Questions for Confluence app has been publicly released, which will likely lead to exploit attempts that give cyberattackers access to all Confluence content.

Patches have been issued, and users have been warned

Atlassian has disclosed yet another critical severity flaw in Confluence. The latest issue is very trivial to exploit as it involves leveraging hardcoded credentials to get wide access to Confluence.

With the number of zero-days spiking in the last 18 months, organisations need to increase patching efforts. Software vendors can be more transparent, too.

With the number of zero-days spiking in the last 18 months, organizations need to increase their patching efforts. Software vendors can be more transparent, too.

Cybercriminals are actively exploiting a recent critical flaw in Atlassian Confluence Server and Data Center to drop crypto miners and ransomware

Most of the attacks involve the use of automated exploits, security vendor says.

A remote code execution vulnerability in multiple Atlassian Confluence products is still under attack by a variety of threat actors nearly two weeks later.