Seems there is an exploit in Confluence again

[Pete OConnell]

I've searched previous posts and the exploit back in 2019 seems to have reared it's head again.

This morning my instance was exploited and I've had to shut it down permenantly.

I'm running 7.12.4 - all I've done is terminate the processes and deleted the confluence user.

[Robert Wen_Cprime_ · Accepted solution]

Hello!

We've been talking about this exploit here: https://community.atlassian.com/t5/Confluence-questions/No-access-to-Conlfuence-Webpage-100-CPU-usage-from-quot-dbused/qaq-p/1793393?utm_source=atlcomm&utm_medium=email&utm_campaign=immediate_general_answer&utm_content=topic

There was also a security advisory last week: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html

Hope this helps!

[Pete OConnell]

Hi Robert,

Seems it answers my question - what is worrying is you're aware of customers who have the software and yet don't advise them of the security advisory.

Thank you for pointing me in the right direction.

[Robert Wen_Cprime_]

I've spoken to my clients and the company I work for has continually spread the word.