Atlassian Vulnerabilities and Affected Products
Vulnerabilities associated with Bamboo Server.
Products
Clear product- Jira Server99 vulnerabilities
- Jira Data Center64 vulnerabilities
- Jira52 vulnerabilities
- Confluence Server38 vulnerabilities
- Confluence Data Center35 vulnerabilities
- Crucible29 vulnerabilities
- Fisheye27 vulnerabilities
- jira_data_center26 vulnerabilities
- jira_server25 vulnerabilities
- Jira Server and Data Center21 vulnerabilities
- Bitbucket Server18 vulnerabilities
- Crowd16 vulnerabilities
- Fisheye and Crucible16 vulnerabilities
- Bamboo15 vulnerabilities
- Jira Service Management Data Center14 vulnerabilities
- Bitbucket Data Center13 vulnerabilities
- Jira Align13 vulnerabilities
- Jira Service Management Server13 vulnerabilities
- Confluence Server and Data Center12 vulnerabilities
- confluence_data_center12 vulnerabilities
- confluence_server10 vulnerabilities
- Bamboo Data Center8 vulnerabilities
- Sourcetree for Windows8 vulnerabilities
- Confluence7 vulnerabilities
- Bamboo Server6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-21689HIGH | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Bamboo Data Center and S… CWE-94Aug 20, 2024 | CVSS8.0v3.1 | EPSS2.67% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-21687HIGH | This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server. This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get the application to display the contents of a local file, or execute a different files already stored locally on the server which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires no user… CWE-98Jul 16, 2024 | CVSS8.1v3.1 | EPSS0.746% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-22516HIGH | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bamboo Data Center and Server custome… Nov 21, 2023 | CVSS8.8v3.1 | EPSS1.22% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-22506HIGH | This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends tha… CWE-94Jul 18, 2023 | CVSS8.8v3.1 | EPSS2.06% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-26137HIGH | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a … | CVSS8.8v3.1 | EPSS2.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-26136CRITICAL | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo… | CVSS9.8v3.1 | EPSS5.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |