Top cybersecurity threats for November 2023

Top takeaways:

• Atlassian reported widespread exploitation of a vulnerability in its Confluence product
• The vendor upgraded the severity of the vulnerability to CVSS 10.0
• Ransomware actors were quick to exploit the bug to compromise victims

Software vendor Atlassian upgraded the severity of a critical vulnerability in its Confluence product after widespread attacks exploited the bug. The firm originally posted a cybersecurity advisory about the improper authorization vulnerability on October 31. The bug (CVE-2023-22518) affects all versions of its Confluence Data Center and Server product (although not Atlassian Cloud sites accessed via atlassian.net). It was originally given a CVSS score of 9.1. Atlassian urged sysadmins to patch, warning that organizations are "vulnerable to significant data loss if exploited by an unauthenticated attacker."

However, the firm updated its guidance on November 2, claiming that it had found "publicly posted critical information about the vulnerability which increases risk of exploitation." Just a day later, it revealed active exploitation. Three days after that, on November 6, the firm upgraded its CVSS score to the maximum, 10.0, due to the "change in the scope of the attack." Widespread exploitation was observed, including attempts to deploy the Cerber ransomware. The incident highlights the speed with which threat actors can pounce on newly published vulnerabilities/exploits, and the need for rapid incident response and risk-based patch management.