A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and     1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. (CVE-2023-6481)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and
    1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. (CVE-2023-6481)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-94111 advisory.

  - This High severity ch.qos.logback:logback-classic Dependency vulnerability was introduced in versions 6.0.1 of     Confluence Data Center and Server. (CVE-2023-6481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
227348	Linux Distros Unpatched Vulnerability : CVE-2023-6481	Nessus	Misc.	high
415193	SCA: security update for ch.qos.logback:logback-core (GHSA-gm62-rw4g-vrc4)	Tenable Cloud Security	SCA Checks	high
415193	SCA: security update for ch.qos.logback:logback-core (GHSA-gm62-rw4g-vrc4)	Tenable Self-Hosted Container Security	SCA Checks	high
191468	Atlassian Confluence 6.0.1 < 7.19.18 / 7.20.x < 8.5.5 / 8.6.x < 8.7.2 / 8.8.0 (CONFSERVER-94111)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2023-6481

high

Tenable Plugins

high

high

high

high