A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.0.9, 8.1.8, 8.2.4, 7.6.16, 7.17.8, and 18 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Atlassian Bamboo Server
fixed in 8.0.9; From 8.1.0; fixed in 8.1.8; From 8.2.0; fixed in 8.2.4
- Atlassian Bamboo Data Center
fixed in 8.0.9; From 8.1.0; fixed in 8.1.8; From 8.2.0; fixed in 8.2.4
- Atlassian Bitbucket Server
fixed in 7.6.16; From 7.7.0; From 7.16.0; fixed in 7.17.8; From 7.18.0; fixed in 7.19.5; From 7.20.0; fixed in 7.20.2; From 7.21.0; fixed in 7.21.2
- Atlassian Bitbucket Data Center
fixed in 7.6.16; From 7.7.0; From 7.16.0; fixed in 7.17.8; From 7.18.0; fixed in 7.19.5; From 7.20.0; fixed in 7.20.2; From 7.21.0; fixed in 7.21.2
- Atlassian Confluence Server
fixed in 7.4.17; From 7.5.0; fixed in 7.13.7; From 7.14.0; fixed in 7.14.3; From 7.15.0; fixed in 7.15.2; From 7.16.0; fixed in 7.16.4; From 7.17.0; fixed in 7.17.4
- Atlassian Confluence Data Center
fixed in 7.4.17; From 7.5.0; fixed in 7.13.7; From 7.14.0; fixed in 7.14.3; From 7.15.0; fixed in 7.15.2; From 7.16.0; fixed in 7.16.4; From 7.17.0; fixed in 7.17.4
- Atlassian Crowd Server
fixed in 4.3.8; From 4.4.0; fixed in 4.4.2
- Atlassian Crowd Data Center
fixed in 4.3.8; From 4.4.0; fixed in 4.4.2
- Atlassian Crucible
fixed in 4.8.10
- Atlassian Fisheye
fixed in 4.8.10
- Atlassian Jira Core Server
fixed in 8.13.22; From 8.14.0; fixed in 8.20.10; From 8.21.0; fixed in 8.22.4
- Atlassian Jira Software Server
fixed in 8.13.22; From 8.14.0; fixed in 8.20.10; From 8.21.0; fixed in 8.22.4
- Atlassian Jira Software Data Center
fixed in 8.13.22; From 8.14.0; fixed in 8.20.10; From 8.21.0; fixed in 8.22.4
- Atlassian Jira Service Management Server
fixed in 4.13.22; From 4.14.0; fixed in 4.20.10; From 4.21.0; fixed in 4.22.4
- Atlassian Jira Service Management Data Center
fixed in 4.13.22; From 4.14.0; fixed in 4.20.10; From 4.21.0; fixed in 4.22.4