Vulnerabilitycritical
Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-14589 | It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur | 9.6 | 2% | ||
| CVE-2019-11581 | Unauthenticated SSTI RCE in Atlassian Jira Server and Data Center | 9.8 | 85% | KEV | KEV |
| CVE-2019-15000 | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version… | 9.8 | 8% | ||
| CVE-2019-3394 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting | 8.8 | 11% | ||
| CVE-2020-14179 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an… | 5.3 | 76% | ||
| CVE-2020-14181 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… | 5.3 | 100% | PoC | |
| CVE-2020-29453 | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0… | 5.3 | 24% | ||
| CVE-2020-36289 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… | 5.3 | 99% | ||
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-26085 | Unauthenticated Arbitrary File Read in Atlassian Confluence Server | 5.3 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-26086 | Path Traversal File Read in Atlassian Jira Server and Data Center | 5.3 | 100% | KEVPoC | KEV |
| CVE-2022-0540 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request | 9.8 | 88% | ||
| CVE-2022-26134 | Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-26138 | Hard-coded Credentials in Atlassian Questions for Confluence App | 9.8 | 98% | KEV | KEV |
From the original article
4 min read at recordedfuture.com
For years, software solutions built by Atlassian have found their way to nearly every organization's software stack. Tools such as JIRA, Confluence, Bamboo, and BitBucket are often seen playing a crucial role in various departments across enterprises.
By Esteban Borges · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.