Security experts are observing attempts to exploit the remote code execution (RCE) vulnerability CVE-2023-22527 affecting outdated Atlassian Confluence servers.
The company disclosed the flaw last week, specifying its impact on Confluence versions released before December 5 2023. It also provided a patch for versions 8.5.4 (LTS) and later.
The critical severity flaw allows unauthenticated, remote attackers to execute code on vulnerable Confluence Data Center and Server endpoints (versions 8.0.x to 8.5.3).
Writing yesterday on X (formerly Twitter), security experts at Shadowserver reported over 39,000 exploitation attempts originating from 600 unique IP addresses, primarily Russian.
Attackers would be executing the ‘whoami’ command for access and privilege information. The total number of accessible Confluence instances is 11,100, but not all run a vulnerable version.
No tags.
