Cyber

What changed

A template injection vulnerability has been discovered in older versions of Atlassian Confluence Data Center and Server. This flaw enables unauthenticated attackers to execute remote code on affected instances, posing a serious security risk.

While recent versions of Confluence have addressed this issue through regular updates, it is crucial for users of older versions to act promptly to mitigate potential threats.

Who is affected

Organizations using older versions of Atlassian Confluence Data Center and Server are at risk of exploitation due to this vulnerability. It is essential for these users to evaluate their current version and take necessary precautions.

The following groups are particularly vulnerable:

• Users of Atlassian Confluence Data Center versions prior to the latest release.
• Organizations that have not applied recent security updates as recommended by Atlassian.
• IT departments responsible for maintaining Confluence instances without regular version checks.

What to do

Affected customers must take immediate action to secure their Confluence instances. Upgrading to the latest supported version is the most effective way to mitigate this vulnerability.

Additionally, reviewing Atlassian's January Security Bulletin for other non-critical vulnerabilities is advised to ensure comprehensive security.

• Upgrade to the latest version of Atlassian Confluence Data Center and Server.
• Conduct a security audit of current Confluence instances to identify vulnerabilities.
• Stay informed about updates and security bulletins from Atlassian to maintain a secure environment.

What changed

An improper access control vulnerability has been identified in GitLab Community and Enterprise Editions. This issue affects multiple versions, allowing password reset emails to be sent to unverified email addresses, which could lead to unauthorized access.

Who is affected

The vulnerability impacts a wide range of users and organizations utilizing GitLab for version control and collaboration.

• GitLab Community Edition users across all affected versions.
• GitLab Enterprise Edition users across all affected versions.
• Organizations relying on GitLab for software development and project management.
• Any individual with an account on GitLab instances running the vulnerable versions.

What to do

It is crucial for affected users to update their GitLab installations to the latest versions to mitigate this vulnerability. Administrators should review their security policies regarding user account management.

• Upgrade to GitLab versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, or 16.7.2 or later.
• Implement additional verification steps for password reset requests.
• Monitor user accounts for any suspicious activity following the vulnerability disclosure.
• Educate users on the importance of securing their email accounts linked to GitLab.