CVE-2023-22524

CVSS 9.6 CRITICALEPSS 24.7%

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Atlassian · Companion for Mac

public PoCs found — 2

githubgithub.com/ron-imperva/CVE-2023-22524★ 25 githubgithub.com/imperva/CVE-2023-22524★ 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos-1319249492.html https://jira.atlassian.com/browse/CONFSERVER-93518