Critical vulnerability in Atlassian Confluence server is under mass exploitation

[ndsipa_pomu]

https://arstechnica.com/security/2023/11/critical-vulnerability-in-atlassian-confluence-server-is-under-mass-exploitation/

[gjvc]

more atlassian shitware

[cypherg → gjvc]

what kind of shit admin leaves an unpatched server with a critical vuln fully exposed to the internet?

[xnzakg → cypherg]

A better question would be how long this vulnerability has been present in Confluence...

[ath3nd → xnzakg]

I believe the CVE is this one: https://confluence.atlassian.com/security/cve-2023-22518-imp..., so since 31-st of Oct (at least that's when it was officially released to the public)