Security Advisory for the week ending July 21, 2023

Situation:
Atlassian has released its Security Bulletin for July 2023.

Problem:
There are vulnerabilities in Confluence Data Center & Server (CVE-2023-22505 and CVE-2023-22508) and Bamboo Data Center (CVE-2023-22506).

Implication:
An attacker can exploit these vulnerabilities to take control of an affected system.

Need:
Apply the necessary updates to address the current vulnerabilities.

Additional Resources:
 
Atlassian Releases Security Updates
 
Security Bulletin – July 18 2023

Situation:
Oracle has released its Critical Patch Update Advisory, Solaris Third Party Bulletin, and Linux Bulletin for July 2023.

Problem:
There are currently multiple vulnerabilities affecting multiple products.

Implication:
A remote attacker can exploit some of these vulnerabilities to take control of an affected system.

Need:
Apply the necessary updates.

Additional Resources:
Oracle Releases Security Updates
Oracle Critical Patch Update Advisory – July 2023
Oracle Solaris Third Party Bulletin – July 2023
Oracle Linux Bulletin – July 2023

CISA Releases Cybersecurity Advisory on Threat Actors Exploiting Citrix CVE-2023-3519

Situation:
The Cybersecurity and Infrastructure Security Agency (CISA) released a Cybersecurity Advisory (CSA), Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells.

Problem:
Threat actors are exploiting CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway.

Implication:
The webshell enabled the actors to perform discovery on the victim’s active directory (AD) and collect and exfiltrate AD data.

Need:
If potential compromise is detected, organizations should apply the incident response recommendations provided in the link below. If no compromise is detected, organizations should immediately apply patches provided by Citrix.

Additional Resources:
CISA Releases Cybersecurity Advisory on Threat Actors Exploiting Citrix CVE-2023-3519
Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells:
Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466, CVE-2023-3467

Adobe Releases Security Updates for ColdFusion
Situation:
Adobe has released security updates to address a critical vulnerability.

Problem:
There is a critical vulnerability (CVE-2023-38203) affecting ColdFusion.

Implication:
An attacker can exploit some of these vulnerabilities to take control of an affected system.

Need:
CISA encourages users and administrators to review the Adobe security release APSB23-41 and apply the necessary updates.

Additional Resources:
Adobe Releases Security Updates for ColdFusion
Adobe Security Bulletin