by Kastro
Paper/Archive/CVE-2023-22523

CVE-2023-22523

Atlassian Assets Discovery Cloud — This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discov…

EPSS 11%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.0.960 × 2019.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.

Affected

ProductAffectedFixed inSource
Assets Discovery Cloud>= 1.0.0–CNA
Assets Discovery Cloud>= 1.5.7.0–CNA
Assets Discovery Cloud>= 1.5.7.1–CNA
Assets Discovery Cloud>= 1.5.7.3–CNA
Assets Discovery Cloud>= 1.5.7.4–CNA
Assets Discovery Cloud>= 1.6.1.2–CNA
Assets Discovery Cloud>= 1.6.2.0–CNA
Assets Discovery Cloud>= 1.6.3.0–CNA
Assets Discovery Cloud>= 1.6.4.0–CNA
Assets Discovery Cloud>= 1.6.4.4–CNA
Assets Discovery Cloud>= 1.7.0.0–CNA
Assets Discovery Cloud>= 1.7.1.0–CNA

Scores by source

atlassian (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refconfluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery-1319248914.htmlrefjira.atlassian.com/browse/JSDSERVER-14925