Digest · Tuesday

Security digest: October 31, 2023

1 editorial brief and 2 known exploited (cisa kev) additions.

All digests · RSS · Markdown

Take stock

Act now: Confluence CVE-2023-22518: Unauthenticated Reset to Admin. Organizations running self-managed Confluence Data Center or Server below the fixed releases, particularly any instance reachable from the internet.
Do you run any of these? F5 BIG-IP Configuration Utility. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-11-21.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Oct 31, 2023 · Vulnerability · CVE-2023-22518

Confluence CVE-2023-22518: Unauthenticated Reset to Admin

Any self-hosted Confluence that is reachable from the internet and not on a fixed release can be wiped and taken over by an unauthenticated request; patch or pull it offline, and Atlassian Cloud users have nothing to do.

Must act: Organizations running self-managed Confluence Data Center or Server below the fixed releases, particularly any instance reachable from the internet.

Can relax: Atlassian Cloud customers (sites on atlassian.net), which Atlassian says are not affected.

Back up the instance and data before making changes.
Upgrade to exactly a listed fixed release (7.19.16, 8.3.4, 8.4.4, 8.5.3, 8.6.1) or a newer supported version.
If you cannot patch now, remove the instance from the internet, including instances that require login.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2023-46748	F5 BIG-IP Configuration Utility F5 BIG-IP Configuration Utility SQL Injection Vulnerability	2023-11-21
CVE-2023-46747	F5 BIG-IP Configuration Utility F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability Ransomware	2023-11-21

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.