Decryption Digest

CVE Analysis & Threat Intelligence Briefings

In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.

Free daily briefing

Every article here lands in subscribers' inboxes the morning it drops.

Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.

Free. No spam. Unsubscribe anytime.

Category:

3 results tagged Atlassian

CVE-2023-22515: Atlassian Confluence Broken Access Control Zero-Day Explained and Fixed

CVE REFERENCEOctober 4, 202310 min

CVE-2023-22515 Confluence BAC: Nation-State Zero-Day

CVE-2023-22515 is a maximum-severity broken access control vulnerability in Atlassian Confluence Data Center and Server. An unauthenticated external attacker can reach Confluence's setup endpoint on a fully configured instance and create a new administrator account, gaining complete control without credentials. Microsoft attributed active exploitation to Storm-0062 (a Chinese state-sponsored threat actor) beginning September 14, 2023, three weeks before Atlassian's advisory.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2022-26134 Explained: Confluence Server Critical OGNL Zero-Day

CVE REFERENCEJune 2, 20229 min

CVE-2022-26134 Confluence Zero-Day: CVSS 10.0 Pre-Auth RCE

CVE-2022-26134 is a critical OGNL injection vulnerability in Atlassian Confluence Server and Data Center, enabling unauthenticated remote code execution. Disclosed as a zero-day on June 2, 2022 with active exploitation already confirmed, this vulnerability scores 10.0 CVSS. Within hours of technical details becoming public, mass scanning and exploitation began across the internet.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2021-26084 Explained: Confluence Server OGNL Injection and Mass Exploitation

CVE REFERENCEAugust 25, 20219 min

CVE-2021-26084 Confluence OGNL Injection: Mass Exploit

CVE-2021-26084 is a server-side template injection vulnerability in Atlassian Confluence Server and Data Center. An unauthenticated attacker can inject OGNL expressions via query parameters, achieving remote code execution on the Confluence server. The vulnerability was exploited at mass scale within hours of public PoC release, with ransomware groups and nation-state actors among the first adopters.