Search
Find a vulnerability
Search criteria
973 vulnerabilities by Atlassian
CERTFR-2026-AVI-0773
Vulnerability from certfr_avis - Published: 2026-06-18 - Updated: 2026-06-18
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Jira | Jira Service Management Data Center et Server versions 11.3.x antérieures à 11.3.7 | ||
| Atlassian | Confluence | Confluence Data Center versions 10.2.x antérieures à 10.2.13 | ||
| Atlassian | Jira | Jira Software Data Center versions 10.3.x antérieures à 10.3.22 | ||
| Atlassian | Jira | Jira Service Management Data Center et Server versions 10.3.x antérieures à 10.3.22 | ||
| Atlassian | Confluence | Confluence Data Center versions 9.2.x antérieures à 9.2.21 | ||
| Atlassian | Jira | Jira Service Management Data Center versions 10.3.x antérieures à 10.3.22 | ||
| Atlassian | Jira | Jira Software Data Center versions 11.3.x antérieures à 11.3.7 | ||
| Atlassian | Jira | Jira Software Data Center et Server versions 10.3.x antérieures à 10.3.22 | ||
| Atlassian | Jira | Jira Service Management Data Center versions 11.3.x antérieures à 11.3.7 | ||
| Atlassian | Jira | Jira Software Data Center et Server versions 9.12.x antérieures à 9.12.36 | ||
| Atlassian | Jira | Jira Software Data Center et Server versions 11.3.x antérieures à 11.3.7 | ||
| Atlassian | Jira | Jira Software Data Center versions 9.12.x antérieures à 9.12.36 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Jira Service Management Data Center et Server versions 11.3.x ant\u00e9rieures \u00e0 11.3.7",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 10.2.x ant\u00e9rieures \u00e0 10.2.13",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 10.3.x ant\u00e9rieures \u00e0 10.3.22",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center et Server versions 10.3.x ant\u00e9rieures \u00e0 10.3.22",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 9.2.x ant\u00e9rieures \u00e0 9.2.21",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions 10.3.x ant\u00e9rieures \u00e0 10.3.22",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 11.3.x ant\u00e9rieures \u00e0 11.3.7",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center et Server versions 10.3.x ant\u00e9rieures \u00e0 10.3.22",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions 11.3.x ant\u00e9rieures \u00e0 11.3.7",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center et Server versions 9.12.x ant\u00e9rieures \u00e0 9.12.36",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center et Server versions 11.3.x ant\u00e9rieures \u00e0 11.3.7",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 9.12.x ant\u00e9rieures \u00e0 9.12.36",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
},
{
"name": "CVE-2026-43515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43515"
},
{
"name": "CVE-2026-42211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42211"
},
{
"name": "CVE-2026-34486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34486"
},
{
"name": "CVE-2026-33870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"name": "CVE-2026-42585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
},
{
"name": "CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"name": "CVE-2026-41284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41284"
},
{
"name": "CVE-2026-45149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45149"
},
{
"name": "CVE-2026-42033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
},
{
"name": "CVE-2026-42035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
},
{
"name": "CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"name": "CVE-2026-42043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
},
{
"name": "CVE-2026-40175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
},
{
"name": "CVE-2026-27903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27903"
},
{
"name": "CVE-2026-34487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
},
{
"name": "CVE-2021-3803",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3803"
},
{
"name": "CVE-2026-42038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42038"
},
{
"name": "CVE-2026-42583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42583"
},
{
"name": "CVE-2026-43513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43513"
},
{
"name": "CVE-2026-29129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29129"
},
{
"name": "CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"name": "CVE-2026-42342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42342"
},
{
"name": "CVE-2026-26996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
},
{
"name": "CVE-2026-42264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42264"
},
{
"name": "CVE-2026-45736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45736"
},
{
"name": "CVE-2026-43512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43512"
},
{
"name": "CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"name": "CVE-2026-42498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42498"
},
{
"name": "CVE-2026-27904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27904"
},
{
"name": "CVE-2026-34077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34077"
},
{
"name": "CVE-2026-41293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41293"
}
],
"initial_release_date": "2026-06-18T00:00:00",
"last_revision_date": "2026-06-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0773",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26825",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26825"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16543",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16543"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16622",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16622"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16604",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16604"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26820",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26820"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26813",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26813"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16583",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16583"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16609",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16609"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16613",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16613"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104143",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104143"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104139",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104139"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16626",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16626"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16614",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16614"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26791",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26791"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104136",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104136"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26783",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26783"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103936",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103936"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26805",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26805"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26800",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26800"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26838",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26838"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16618",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16618"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26815",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26815"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26819",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26819"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104131",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104131"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104199",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104199"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103906",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103906"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26751",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26751"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16620",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16620"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16615",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16615"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16632",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16632"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16627",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16627"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103468",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103468"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26841",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26841"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26818",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26818"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26837",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26837"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104132",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104132"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16608",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16608"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26835",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26835"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104134",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104134"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16616",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16616"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16610",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16610"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16617",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16617"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26821",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26821"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26784",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26784"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16623",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16623"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104133",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104133"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26840",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26840"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104130",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104130"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16629",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16629"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26752",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26752"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26827",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26827"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16606",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16606"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16628",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16628"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26816",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26816"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104135",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104135"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26811",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26811"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26826",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26826"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16541",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16541"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104138",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104138"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26822",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26822"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16607",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16607"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16631",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16631"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16625",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16625"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-104171",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104171"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16621",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16621"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16584",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16584"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26814",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26814"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16611",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16611"
},
{
"published_at": "2026-06-16",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26836",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26836"
}
]
}
CERTFR-2026-AVI-0621
Vulnerability from certfr_avis - Published: 2026-05-20 - Updated: 2026-05-20
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Jira | Jira Software Data Center versions antérieures à 10.3.20 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 11.3.5 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 10.2.11 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 10.3.20 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 11.3.5 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.2.20 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 9.12.35 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 10.3.20 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 11.3.5 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 10.3.20",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 11.3.5",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 10.2.11",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.20",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 11.3.5",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.20",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.35",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.20",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 11.3.5",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-24734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24734"
},
{
"name": "CVE-2026-29145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
},
{
"name": "CVE-2026-22029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
},
{
"name": "CVE-2026-29146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29146"
},
{
"name": "CVE-2026-33750",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33750"
},
{
"name": "CVE-2026-26960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26960"
},
{
"name": "CVE-2026-22732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22732"
},
{
"name": "CVE-2026-34487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
},
{
"name": "CVE-2026-29062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29062"
},
{
"name": "CVE-2026-29786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29786"
},
{
"name": "CVE-2026-25639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
},
{
"name": "CVE-2026-29129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29129"
},
{
"name": "CVE-2026-34483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34483"
},
{
"name": "CVE-2026-24880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24880"
},
{
"name": "CVE-2026-31802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31802"
}
],
"initial_release_date": "2026-05-20T00:00:00",
"last_revision_date": "2026-05-20T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0621",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-05-20T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103710",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103710"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16574",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16574"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26786",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26786"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16576",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16576"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103709",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103709"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103708",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103708"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16588",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16588"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26781",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26781"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16571",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16571"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16573",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16573"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103633",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103633"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26778",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26778"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26780",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26780"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26788",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26788"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103713",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103713"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16587",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16587"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26793",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26793"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26785",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26785"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16577",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16577"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103712",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103712"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26787",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26787"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16578",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16578"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103707",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103707"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103647",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103647"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26782",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26782"
},
{
"published_at": "2026-05-19",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16575",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16575"
}
]
}
CERTFR-2026-AVI-0479
Vulnerability from certfr_avis - Published: 2026-04-22 - Updated: 2026-04-22
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Confluence | Confluence Data Center versions 10.x antérieures à 10.2.10 | ||
| Atlassian | Jira | Jira Service Management Data Center versions 11.x antérieures à 11.3.4 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 9.12.33 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.2.19 | ||
| Atlassian | Jira | Jira Software Data Center versions 10.x antérieures à 10.3.19 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 9.12.34 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 10.3.19 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 10.3.13 | ||
| Atlassian | Jira | Jira Software Server versions 10.x antérieures à 10.3.16 | ||
| Atlassian | Jira | Jira Software Data Center versions 11.x antérieures à 11.3.4 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Confluence Data Center versions 10.x ant\u00e9rieures \u00e0 10.2.10",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions 11.x ant\u00e9rieures \u00e0 11.3.4",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 9.12.33",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.19",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 10.x ant\u00e9rieures \u00e0 10.3.19",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.34",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.19",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.13",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions 10.x ant\u00e9rieures \u00e0 10.3.16",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 11.x ant\u00e9rieures \u00e0 11.3.4",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-33871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
},
{
"name": "CVE-2023-1370",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1370"
},
{
"name": "CVE-2021-0341",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
},
{
"name": "CVE-2023-48631",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-48631"
},
{
"name": "CVE-2026-23745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
},
{
"name": "CVE-2026-33870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"name": "CVE-2026-22029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
},
{
"name": "CVE-2023-3635",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
},
{
"name": "CVE-2026-26960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26960"
},
{
"name": "CVE-2024-45801",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45801"
},
{
"name": "CVE-2021-31597",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31597"
},
{
"name": "CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"name": "CVE-2026-23950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
},
{
"name": "CVE-2024-29371",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
},
{
"name": "CVE-2024-47875",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
},
{
"name": "CVE-2026-25639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
},
{
"name": "CVE-2025-66020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66020"
},
{
"name": "CVE-2022-1471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
},
{
"name": "CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"name": "CVE-2026-31802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31802"
},
{
"name": "CVE-2026-25547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
},
{
"name": "CVE-2025-48734",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48734"
}
],
"initial_release_date": "2026-04-22T00:00:00",
"last_revision_date": "2026-04-22T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0479",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-04-22T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26754",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26754"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16542",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16542"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26657",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26657"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16551",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16551"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26764",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26764"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103476",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103476"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103467",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103467"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103471",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103471"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103469",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103469"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103475",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103475"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16544",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16544"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103470",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103470"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103472",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103472"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103612",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103612"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103539",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103539"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103474",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103474"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26666",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26666"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16557",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16557"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103517",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103517"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16550",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16550"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16540",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16540"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26765",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26765"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26763",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26763"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26760",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26760"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16552",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16552"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16556",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16556"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102567",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102567"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103473",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103473"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103516",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103516"
},
{
"published_at": "2026-04-21",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103518",
"url": "https://jira.atlassian.com/browse/CONFSERVER-103518"
}
]
}
CERTFR-2026-AVI-0314
Vulnerability from certfr_avis - Published: 2026-03-18 - Updated: 2026-03-18
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Jira | Jira Software Server versions antérieures à 10.3.17 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 11.3.2 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 10.2.7 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 11.3.3 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 9.0.2 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 11.3.3 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.0.2 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 10.3.18 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 9.2.15 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 11.3.3 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.2.15 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 10.2.7 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 10.3.17 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 10.3.18 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 10.3.17",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 11.3.2",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 10.2.7",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 11.3.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 9.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 11.3.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 10.3.18",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 9.2.15",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 11.3.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.15",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 10.2.7",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.17",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.18",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2022-25883",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25883"
},
{
"name": "CVE-2026-23745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
},
{
"name": "CVE-2022-25927",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25927"
},
{
"name": "CVE-2026-24842",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
},
{
"name": "CVE-2026-23950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
},
{
"name": "CVE-2025-64756",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64756"
},
{
"name": "CVE-2020-28469",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28469"
},
{
"name": "CVE-2024-57699",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-57699"
}
],
"initial_release_date": "2026-03-18T00:00:00",
"last_revision_date": "2026-03-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0314",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16515",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16515"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16527",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16527"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26730",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26730"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16530",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16530"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26714",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26714"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26736",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26736"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26716",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26716"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102542",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102542"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16529",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16529"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16510",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16510"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26732",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26732"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16528",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16528"
},
{
"published_at": "2026-03-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26733",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26733"
}
]
}
CERTFR-2026-AVI-0182
Vulnerability from certfr_avis - Published: 2026-02-18 - Updated: 2026-02-18
De multiples vulnérabilités ont été découvertes dans Atlassian Confluence. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Confluence | Confluence Server versions 9.4.x antérieures à 9.4.0 | ||
| Atlassian | Confluence | Confluence Data Center versions 9.4.x antérieures à 9.4.0 | ||
| Atlassian | Confluence | Confluence Data Center versions 9.5.x antérieures à 9.5.3 | ||
| Atlassian | Confluence | Confluence Server versions 10.1.x antérieures à 10.1.0 | ||
| Atlassian | Confluence | Confluence Server versions 10.0.x antérieures à 10.0.2 | ||
| Atlassian | Confluence | Confluence Data Center versions 10.0.x antérieures à 10.0.2 | ||
| Atlassian | Confluence | Confluence Server versions 9.2.x antérieures à 9.2.7 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 8.5.10 | ||
| Atlassian | Confluence | Confluence Server versions 9.5.x antérieures à 9.5.3 | ||
| Atlassian | Confluence | Confluence Data Center versions 10.1.x antérieures à 10.1.0 | ||
| Atlassian | Confluence | Confluence Data Center versions 10.2.x antérieures à 10.2.6 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 8.5.10 | ||
| Atlassian | Confluence | Confluence Server versions 10.2.x antérieures à 10.2.6 | ||
| Atlassian | Confluence | Confluence Data Center versions 9.2.x antérieures à 9.2.15 | ||
| Atlassian | Confluence | Confluence Data Center versions 9.3.x antérieures à 9.3.1 | ||
| Atlassian | Confluence | Confluence Server versions 9.3.x antérieures à 9.3.1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Confluence Server versions 9.4.x ant\u00e9rieures \u00e0 9.4.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 9.4.x ant\u00e9rieures \u00e0 9.4.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 9.5.x ant\u00e9rieures \u00e0 9.5.3",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 10.1.x ant\u00e9rieures \u00e0 10.1.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 10.0.x ant\u00e9rieures \u00e0 10.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 10.0.x ant\u00e9rieures \u00e0 10.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 9.2.x ant\u00e9rieures \u00e0 9.2.7",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 8.5.10",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 9.5.x ant\u00e9rieures \u00e0 9.5.3",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 10.1.x ant\u00e9rieures \u00e0 10.1.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 10.2.x ant\u00e9rieures \u00e0 10.2.6",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 8.5.10",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 10.2.x ant\u00e9rieures \u00e0 10.2.6",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 9.2.x ant\u00e9rieures \u00e0 9.2.15",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 9.3.x ant\u00e9rieures \u00e0 9.3.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 9.3.x ant\u00e9rieures \u00e0 9.3.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2022-25883",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25883"
},
{
"name": "CVE-2022-25927",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25927"
},
{
"name": "CVE-2025-48976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
},
{
"name": "CVE-2025-41249",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-41249"
},
{
"name": "CVE-2020-28469",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28469"
},
{
"name": "CVE-2025-59343",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59343"
}
],
"initial_release_date": "2026-02-18T00:00:00",
"last_revision_date": "2026-02-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0182",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Atlassian Confluence. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Atlassian Confluence",
"vendor_advisories": [
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102185",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102185"
},
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101930",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101930"
},
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102184",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102184"
},
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102186",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102186"
},
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102193",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102193"
},
{
"published_at": "2026-02-17",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102132",
"url": "https://jira.atlassian.com/browse/CONFSERVER-102132"
}
]
}
CERTFR-2026-AVI-0065
Vulnerability from certfr_avis - Published: 2026-01-21 - Updated: 2026-01-21
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Jira | Jira Software Server versions 11.3.x antérieures à 11.3.0 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 8.5.31 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 5.12.29 | ||
| Atlassian | Jira | Jira Service Management Server versions 11.x antérieures à 11.2.1 | ||
| Atlassian | Jira | Jira Service Management Data Center versions 11.x antérieures à 11.2.1 | ||
| Atlassian | Jira | Jira Software Data Center versions 11.2.x antérieures à 11.2.1 | ||
| Atlassian | Jira | Jira Software Server versions 11.2.x antérieures à 11.2.1 | ||
| Atlassian | Jira | Jira Software Data Center versions 10.x antérieures à 10.3.16 | ||
| Atlassian | Jira | Jira Service Management Server versions 10.x antérieures à 10.3.16 | ||
| Atlassian | Jira | Jira Service Management Server versions 11.3.x antérieures à 11.3.0 | ||
| Atlassian | Confluence | Confluence Server versions 9.x antérieures à 9.2.13 | ||
| Atlassian | Confluence | Confluence Data Center versions 10.x antérieures à 10.2.2 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 9.12.26 | ||
| Atlassian | Jira | Jira Service Management Data Center versions 11.3.x antérieures à 11.3.1 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 8.5.31 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 9.12.26 | ||
| Atlassian | Confluence | Confluence Data Center versions 9.x antérieures à 9.2.13 | ||
| Atlassian | Jira | Jira Service Management Data Center versions 10.x antérieures à 10.3.16 | ||
| Atlassian | Jira | Jira Software Server versions 10.x antérieures à 10.3.16 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 5.12.29 | ||
| Atlassian | Jira | Jira Software Data Center versions 11.3.x antérieures à 11.3.0 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Jira Software Server versions 11.3.x ant\u00e9rieures \u00e0 11.3.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 8.5.31",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 5.12.29",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions 11.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions 11.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 11.2.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions 11.2.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 10.x ant\u00e9rieures \u00e0 10.3.16",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions 10.x ant\u00e9rieures \u00e0 10.3.16",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions 11.3.x ant\u00e9rieures \u00e0 11.3.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions 9.x ant\u00e9rieures \u00e0 9.2.13",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 10.x ant\u00e9rieures \u00e0 10.2.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.26",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions 11.3.x ant\u00e9rieures \u00e0 11.3.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 8.5.31",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 9.12.26",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions 9.x ant\u00e9rieures \u00e0 9.2.13",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions 10.x ant\u00e9rieures \u00e0 10.3.16",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions 10.x ant\u00e9rieures \u00e0 10.3.16",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 5.12.29",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions 11.3.x ant\u00e9rieures \u00e0 11.3.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-9287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9287"
},
{
"name": "CVE-2025-49146",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49146"
},
{
"name": "CVE-2022-25883",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25883"
},
{
"name": "CVE-2025-66516",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66516"
},
{
"name": "CVE-2025-15284",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
},
{
"name": "CVE-2024-21538",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21538"
},
{
"name": "CVE-2024-45296",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
},
{
"name": "CVE-2021-3807",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3807"
},
{
"name": "CVE-2024-45801",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45801"
},
{
"name": "CVE-2022-45693",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45693"
},
{
"name": "CVE-2025-54988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54988"
},
{
"name": "CVE-2025-9288",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9288"
},
{
"name": "CVE-2025-52434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52434"
},
{
"name": "CVE-2025-53689",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53689"
}
],
"initial_release_date": "2026-01-21T00:00:00",
"last_revision_date": "2026-01-21T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0065",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-21T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26667",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26667"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16497",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16497"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16496",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16496"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101827",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101827"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26665",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26665"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16485",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16485"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26661",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26661"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16491",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16491"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101878",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101878"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16501",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16501"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26663",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26663"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16503",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16503"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26662",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26662"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16459",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16459"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26654",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26654"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26656",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26656"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101872",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101872"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16502",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16502"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101842",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101842"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16499",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16499"
},
{
"published_at": "2026-01-20",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16465",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16465"
}
]
}
CERTFR-2025-AVI-1100
Vulnerability from certfr_avis - Published: 2025-12-12 - Updated: 2025-12-12
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Jira | Jira Software Data Center et Server versions 9.12.x antérieures à 9.12.30 | ||
| Atlassian | Jira | Jira Software Data Center et Server versions 10.3.x antérieures à 10.3.15 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 9.5.x antérieures à 9.5.2 | ||
| Atlassian | Jira | Jira Service Management Data Center et Server versions 11.x antérieures à 11.2.1 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 10.0.x antérieures à 10.0.2 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 8.5.x antérieures à 8.5.30 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 10.1.x antérieures à 10.1.0 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 9.2.x antérieures à 9.2.12 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 9.3.x antérieures à 9.3.1 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 9.4.x antérieures à 9.4.0 | ||
| Atlassian | Jira | Jira Service Management Data Center et Server versions 10.3.x antérieures à 10.3.15 | ||
| Atlassian | Jira | Jira Software Data Center et Server versions 11.x antérieures à 11.2.1 | ||
| Atlassian | Confluence | Confluence Data Center et Server versions 10.2.x antérieures à 10.2.1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Jira Software Data Center et Server versions 9.12.x ant\u00e9rieures \u00e0 9.12.30",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center et Server versions 10.3.x ant\u00e9rieures \u00e0 10.3.15",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 9.5.x ant\u00e9rieures \u00e0 9.5.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center et Server versions 11.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 10.0.x ant\u00e9rieures \u00e0 10.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 8.5.x ant\u00e9rieures \u00e0 8.5.30",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 10.1.x ant\u00e9rieures \u00e0 10.1.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 9.2.x ant\u00e9rieures \u00e0 9.2.12",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 9.3.x ant\u00e9rieures \u00e0 9.3.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 9.4.x ant\u00e9rieures \u00e0 9.4.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center et Server versions 10.3.x ant\u00e9rieures \u00e0 10.3.15",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center et Server versions 11.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center et Server versions 10.2.x ant\u00e9rieures \u00e0 10.2.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2021-39227",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39227"
},
{
"name": "CVE-2022-37603",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37603"
},
{
"name": "CVE-2025-66516",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66516"
},
{
"name": "CVE-2024-29415",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29415"
},
{
"name": "CVE-2025-41248",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-41248"
},
{
"name": "CVE-2025-27152",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27152"
},
{
"name": "CVE-2024-21634",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21634"
},
{
"name": "CVE-2022-37601",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37601"
},
{
"name": "CVE-2025-48976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
},
{
"name": "CVE-2022-45693",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45693"
},
{
"name": "CVE-2016-1181",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1181"
},
{
"name": "CVE-2025-54988",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-54988"
},
{
"name": "CVE-2025-55163",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55163"
},
{
"name": "CVE-2023-49735",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49735"
},
{
"name": "CVE-2022-3517",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3517"
},
{
"name": "CVE-2024-12905",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12905"
},
{
"name": "CVE-2020-8203",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8203"
},
{
"name": "CVE-2022-37599",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37599"
},
{
"name": "CVE-2025-58754",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-58754"
},
{
"name": "CVE-2016-1182",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1182"
}
],
"initial_release_date": "2025-12-12T00:00:00",
"last_revision_date": "2025-12-12T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1100",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-12-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16469",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16469"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26599",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26599"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101574",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101574"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26636",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26636"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26600",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26600"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16461",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16461"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16478",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16478"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26614",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26614"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16458",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16458"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26630",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26630"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26627",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26627"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26634",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26634"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16466",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16466"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101788",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101788"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101478",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101478"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101573",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101573"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16477",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16477"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26635",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26635"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16470",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16470"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26629",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26629"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16479",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16479"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26625",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26625"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26626",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26626"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101575",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101575"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16462",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16462"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101489",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101489"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26619",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26619"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16456",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16456"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26615",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26615"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26628",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26628"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16480",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16480"
},
{
"published_at": "2025-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26620",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26620"
}
]
}
CERTFR-2025-AVI-1025
Vulnerability from certfr_avis - Published: 2025-11-19 - Updated: 2025-11-19
De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une falsification de requêtes côté serveur (SSRF).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Atlassian | Jira | Jira Software Data Center versions antérieures à 11.2.0 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 10.3.10 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 10.7.3 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 9.5.4 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 9.2.6 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 10.7.3 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 11.2.0 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 5.12.26 | ||
| Atlassian | Jira | Jira Service Management Data Center versions antérieures à 10.3.10 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 11.2.0 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 10.7.3 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 11.2.0 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.2.6 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 10.0.2 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 9.12.26 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 10.1.1 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 10.1.1 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 5.12.26 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.3.1 | ||
| Atlassian | Jira | Jira Software Data Center versions antérieures à 10.7.3 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 10.3.10 | ||
| Atlassian | Jira | Jira Software Server versions antérieures à 9.12.26 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 8.5.20 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 9.4.0 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 10.0.2 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.5.4 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 8.5.20 | ||
| Atlassian | Confluence | Confluence Data Center versions antérieures à 9.4.0 | ||
| Atlassian | Jira | Jira Service Management Server versions antérieures à 10.3.10 | ||
| Atlassian | Confluence | Confluence Server versions antérieures à 9.3.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 11.2.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 10.3.10",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.7.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 9.5.4",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 9.2.6",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.7.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 11.2.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 5.12.26",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.10",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 11.2.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 10.7.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 11.2.0",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.6",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 10.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.26",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 10.1.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 10.1.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 5.12.26",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.3.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 10.7.3",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 10.3.10",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Software Server versions ant\u00e9rieures \u00e0 9.12.26",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 8.5.20",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 9.4.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 10.0.2",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.5.4",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 8.5.20",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.4.0",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.10",
"product": {
"name": "Jira",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
},
{
"description": "Confluence Server versions ant\u00e9rieures \u00e0 9.3.1",
"product": {
"name": "Confluence",
"vendor": {
"name": "Atlassian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2022-46175",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-46175"
},
{
"name": "CVE-2025-41248",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-41248"
},
{
"name": "CVE-2024-45296",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
},
{
"name": "CVE-2025-48976",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
},
{
"name": "CVE-2024-37890",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37890"
},
{
"name": "CVE-2022-38900",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38900"
},
{
"name": "CVE-2023-42282",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42282"
},
{
"name": "CVE-2025-48387",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48387"
}
],
"initial_release_date": "2025-11-19T00:00:00",
"last_revision_date": "2025-11-19T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-1025",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
"vendor_advisories": [
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101488",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101488"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16435",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16435"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26537",
"url": "https://jira.atlassian.com/browse/JSWSERVER-26537"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101480",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101480"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101486",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101486"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101487",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101487"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101485",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101485"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101479",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101479"
},
{
"published_at": "2025-11-18",
"title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-101477",
"url": "https://jira.atlassian.com/browse/CONFSERVER-101477"
}
]
}
CVE-2026-21571 (GCVE-0-2026-21571)
Vulnerability from nvd – Published: 2026-04-21 17:00 – Updated: 2026-04-23 03:56
VLAI
EPSS
VEX
Summary
This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0,
11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands
on the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability,
and requires no user interaction.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade
your instance to one of the specified supported fixed versions:
Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25
Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18
Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6
See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- OS Command Injection
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Bamboo Data Center |
Affected:
12.1.0 to 12.1.3
Affected: 12.0.0 to 12.0.2 Affected: 11.0.0 to 11.0.8 Affected: 10.2.0 to 10.2.16 Affected: 10.1.0 to 10.1.1 Affected: 10.0.0 to 10.0.3 Affected: 9.6.2 to 9.6.24 Unaffected: 12.1.6 Unaffected: 10.2.18 Unaffected: 9.6.25 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21571",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T03:56:05.653Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Bamboo Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "12.1.0 to 12.1.3"
},
{
"status": "affected",
"version": "12.0.0 to 12.0.2"
},
{
"status": "affected",
"version": "11.0.0 to 11.0.8"
},
{
"status": "affected",
"version": "10.2.0 to 10.2.16"
},
{
"status": "affected",
"version": "10.1.0 to 10.1.1"
},
{
"status": "affected",
"version": "10.0.0 to 10.0.3"
},
{
"status": "affected",
"version": "9.6.2 to 9.6.24"
},
{
"status": "unaffected",
"version": "12.1.6"
},
{
"status": "unaffected",
"version": "10.2.18"
},
{
"status": "unaffected",
"version": "9.6.25"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:data_center:*:*:*",
"versionEndIncluding": "9.6.24",
"versionStartIncluding": "9.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.6:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.7:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.8:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.9:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.10:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.11:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.12:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.13:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.14:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.15:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.16:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.17:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.18:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.19:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.20:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.21:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.22:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.23:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.24:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.25:*:*:*:data_center:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0,\r\n11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.\r\n\u00a0\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of\r\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands\r\non the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability,\r\nand requires no user interaction.\r\n\u00a0\r\nAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade\r\nyour instance to one of the specified supported fixed versions:\r\n Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25\r\n Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18\u00a0\r\n Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6\r\n\r\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives])."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS Command Injection",
"lang": "en",
"type": "OS Command Injection"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T17:00:05.524Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1770913890"
},
{
"url": "https://jira.atlassian.com/browse/BAM-26364"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2026-21571",
"datePublished": "2026-04-21T17:00:05.524Z",
"dateReserved": "2026-01-01T00:00:40.720Z",
"dateUpdated": "2026-04-23T03:56:05.653Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21570 (GCVE-0-2026-21570)
Vulnerability from nvd – Published: 2026-03-17 18:00 – Updated: 2026-03-17 18:21
VLAI
EPSS
VEX
Summary
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24
Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16
Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3
See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).
This vulnerability was reported via our Atlassian (Internal) program.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- RCE (Remote Code Execution)
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Bamboo Data Center |
Affected:
12.1.0 to 12.1.2
Affected: 12.0.0 to 12.0.2 Affected: 11.0.0 to 11.0.8 Affected: 10.2.0 to 10.2.15 Affected: 10.1.0 to 10.1.1 Affected: 10.0.0 to 10.0.3 Affected: 9.6.1 to 9.6.23 Unaffected: 12.1.3 Unaffected: 10.2.16 Unaffected: 9.6.24 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21570",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-17T18:21:29.754925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T18:21:46.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Bamboo Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "12.1.0 to 12.1.2"
},
{
"status": "affected",
"version": "12.0.0 to 12.0.2"
},
{
"status": "affected",
"version": "11.0.0 to 11.0.8"
},
{
"status": "affected",
"version": "10.2.0 to 10.2.15"
},
{
"status": "affected",
"version": "10.1.0 to 10.1.1"
},
{
"status": "affected",
"version": "10.0.0 to 10.0.3"
},
{
"status": "affected",
"version": "9.6.1 to 9.6.23"
},
{
"status": "unaffected",
"version": "12.1.3"
},
{
"status": "unaffected",
"version": "10.2.16"
},
{
"status": "unaffected",
"version": "9.6.24"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:data_center:*:*:*",
"versionEndIncluding": "9.6.23",
"versionStartIncluding": "9.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.6:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.7:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.8:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.9:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.10:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.11:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.12:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.13:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.14:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.15:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.16:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.17:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.18:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.19:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.20:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.21:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.22:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.23:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.24:*:*:*:data_center:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This High severity RCE (Remote Code Execution)\u00a0 vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.\r\n\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.\r\n\r\nAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24\r\n\r\n Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16\r\n\r\n Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3\r\n\r\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "RCE (Remote Code Execution)",
"lang": "en",
"type": "RCE (Remote Code Execution)"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T18:00:00.907Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1721271371"
},
{
"url": "https://jira.atlassian.com/browse/BAM-26342"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2026-21570",
"datePublished": "2026-03-17T18:00:00.907Z",
"dateReserved": "2026-01-01T00:00:40.720Z",
"dateUpdated": "2026-03-17T18:21:46.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21569 (GCVE-0-2026-21569)
Vulnerability from nvd – Published: 2026-01-28 00:30 – Updated: 2026-01-28 14:49
VLAI
EPSS
VEX
Summary
This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.
This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction.
Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3
See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive).
This vulnerability was reported via our Atlassian (Internal) program.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- XXE (XML External Entity Injection)
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Crowd Data Center |
Affected:
7.1.0 to 7.1.2
Unaffected: 7.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-28T14:49:16.812896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T14:49:56.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Crowd Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "7.1.0 to 7.1.2"
},
{
"status": "unaffected",
"version": "7.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. \n\t\n\tThis XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. \n\t\n\tAtlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Atlassian (Internal) program."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XXE (XML External Entity Injection)",
"lang": "en",
"type": "XXE (XML External Entity Injection)"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T00:30:00.557Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819"
},
{
"url": "https://jira.atlassian.com/browse/CWD-6453"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2026-21569",
"datePublished": "2026-01-28T00:30:00.557Z",
"dateReserved": "2026-01-01T00:00:40.720Z",
"dateUpdated": "2026-01-28T14:49:56.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-22178 (GCVE-0-2025-22178)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-22 17:21
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T17:21:18.410947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T17:21:57.848Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the \"Why\" page."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.731Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8647"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22178",
"datePublished": "2025-10-22T16:30:04.731Z",
"dateReserved": "2025-01-01T00:01:27.178Z",
"dateUpdated": "2025-10-22T17:21:57.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22177 (GCVE-0-2025-22177)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-22 18:48
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22177",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T18:48:37.219728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T18:48:41.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:00.632Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8646"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22177",
"datePublished": "2025-10-22T16:30:00.632Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-22T18:48:41.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22176 (GCVE-0-2025-22176)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-23 17:40
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22176",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T17:40:44.569011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T17:40:48.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:02.956Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8645"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22176",
"datePublished": "2025-10-22T16:30:02.956Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-23T17:40:48.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22175 (GCVE-0-2025-22175)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-27 16:09
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T18:08:17.435004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T16:09:06.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user\u0027s private checklist."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:00.592Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8644"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22175",
"datePublished": "2025-10-22T16:30:00.592Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-27T16:09:06.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22174 (GCVE-0-2025-22174)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-22 19:39
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T19:39:21.470781Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T19:39:25.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.050Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8643"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22174",
"datePublished": "2025-10-22T16:30:04.050Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-22T19:39:25.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22173 (GCVE-0-2025-22173)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-22 19:12
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T19:12:13.342584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T19:12:18.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.376Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8642"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22173",
"datePublished": "2025-10-22T16:30:04.376Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-22T19:12:18.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22172 (GCVE-0-2025-22172)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-23 17:32
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T17:32:37.765130Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T17:32:42.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:03.984Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8641"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22172",
"datePublished": "2025-10-22T16:30:03.984Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-23T17:32:42.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22171 (GCVE-0-2025-22171)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-23 18:11
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-23T18:11:49.143375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-23T18:11:55.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:01.353Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8640"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22171",
"datePublished": "2025-10-22T16:30:01.353Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-23T18:11:55.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22170 (GCVE-0-2025-22170)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-22 19:16
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T19:16:03.345408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T19:16:07.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.355Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8639"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22170",
"datePublished": "2025-10-22T16:30:04.355Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-22T19:16:07.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22169 (GCVE-0-2025-22169)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-22 17:24
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T17:23:53.628155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T17:24:43.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.452Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8638"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22169",
"datePublished": "2025-10-22T16:30:04.452Z",
"dateReserved": "2025-01-01T00:01:27.176Z",
"dateUpdated": "2025-10-22T17:24:43.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22168 (GCVE-0-2025-22168)
Vulnerability from nvd – Published: 2025-10-22 16:30 – Updated: 2025-10-24 14:45
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-24T14:45:17.604258Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-24T14:45:20.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user\u0027s private checklist."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:00.663Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8637"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22168",
"datePublished": "2025-10-22T16:30:00.663Z",
"dateReserved": "2025-01-01T00:01:27.176Z",
"dateUpdated": "2025-10-24T14:45:20.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-21571 (GCVE-0-2026-21571)
Vulnerability from cvelistv5 – Published: 2026-04-21 17:00 – Updated: 2026-04-23 03:56
VLAI
EPSS
VEX
Summary
This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0,
11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands
on the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability,
and requires no user interaction.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade
your instance to one of the specified supported fixed versions:
Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25
Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18
Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6
See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- OS Command Injection
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Bamboo Data Center |
Affected:
12.1.0 to 12.1.3
Affected: 12.0.0 to 12.0.2 Affected: 11.0.0 to 11.0.8 Affected: 10.2.0 to 10.2.16 Affected: 10.1.0 to 10.1.1 Affected: 10.0.0 to 10.0.3 Affected: 9.6.2 to 9.6.24 Unaffected: 12.1.6 Unaffected: 10.2.18 Unaffected: 9.6.25 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21571",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-23T03:56:05.653Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Bamboo Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "12.1.0 to 12.1.3"
},
{
"status": "affected",
"version": "12.0.0 to 12.0.2"
},
{
"status": "affected",
"version": "11.0.0 to 11.0.8"
},
{
"status": "affected",
"version": "10.2.0 to 10.2.16"
},
{
"status": "affected",
"version": "10.1.0 to 10.1.1"
},
{
"status": "affected",
"version": "10.0.0 to 10.0.3"
},
{
"status": "affected",
"version": "9.6.2 to 9.6.24"
},
{
"status": "unaffected",
"version": "12.1.6"
},
{
"status": "unaffected",
"version": "10.2.18"
},
{
"status": "unaffected",
"version": "9.6.25"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:data_center:*:*:*",
"versionEndIncluding": "9.6.24",
"versionStartIncluding": "9.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.6:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.7:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.8:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.9:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.10:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.11:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.12:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.13:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.14:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.15:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.16:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.17:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.18:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.19:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.20:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.21:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.22:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.23:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.24:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.25:*:*:*:data_center:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0,\r\n11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.\r\n\u00a0\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of\r\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands\r\non the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability,\r\nand requires no user interaction.\r\n\u00a0\r\nAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade\r\nyour instance to one of the specified supported fixed versions:\r\n Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25\r\n Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18\u00a0\r\n Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6\r\n\r\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives])."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS Command Injection",
"lang": "en",
"type": "OS Command Injection"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T17:00:05.524Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1770913890"
},
{
"url": "https://jira.atlassian.com/browse/BAM-26364"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2026-21571",
"datePublished": "2026-04-21T17:00:05.524Z",
"dateReserved": "2026-01-01T00:00:40.720Z",
"dateUpdated": "2026-04-23T03:56:05.653Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21570 (GCVE-0-2026-21570)
Vulnerability from cvelistv5 – Published: 2026-03-17 18:00 – Updated: 2026-03-17 18:21
VLAI
EPSS
VEX
Summary
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24
Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16
Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3
See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).
This vulnerability was reported via our Atlassian (Internal) program.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- RCE (Remote Code Execution)
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Bamboo Data Center |
Affected:
12.1.0 to 12.1.2
Affected: 12.0.0 to 12.0.2 Affected: 11.0.0 to 11.0.8 Affected: 10.2.0 to 10.2.15 Affected: 10.1.0 to 10.1.1 Affected: 10.0.0 to 10.0.3 Affected: 9.6.1 to 9.6.23 Unaffected: 12.1.3 Unaffected: 10.2.16 Unaffected: 9.6.24 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21570",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-17T18:21:29.754925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T18:21:46.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Bamboo Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "12.1.0 to 12.1.2"
},
{
"status": "affected",
"version": "12.0.0 to 12.0.2"
},
{
"status": "affected",
"version": "11.0.0 to 11.0.8"
},
{
"status": "affected",
"version": "10.2.0 to 10.2.15"
},
{
"status": "affected",
"version": "10.1.0 to 10.1.1"
},
{
"status": "affected",
"version": "10.0.0 to 10.0.3"
},
{
"status": "affected",
"version": "9.6.1 to 9.6.23"
},
{
"status": "unaffected",
"version": "12.1.3"
},
{
"status": "unaffected",
"version": "10.2.16"
},
{
"status": "unaffected",
"version": "9.6.24"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:data_center:*:*:*",
"versionEndIncluding": "9.6.23",
"versionStartIncluding": "9.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.6:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.7:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.8:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.9:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.10:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.11:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.12:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.13:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.14:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.15:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.16:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.17:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.18:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.19:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.20:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.21:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.22:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.23:*:*:*:data_center:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:atlassian:bamboo:9.6.24:*:*:*:data_center:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This High severity RCE (Remote Code Execution)\u00a0 vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.\r\n\r\nThis RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.\r\n\r\nAtlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\r\n Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24\r\n\r\n Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16\r\n\r\n Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3\r\n\r\nSee the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).\r\n\r\nThis vulnerability was reported via our Atlassian (Internal) program."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "RCE (Remote Code Execution)",
"lang": "en",
"type": "RCE (Remote Code Execution)"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-17T18:00:00.907Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1721271371"
},
{
"url": "https://jira.atlassian.com/browse/BAM-26342"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2026-21570",
"datePublished": "2026-03-17T18:00:00.907Z",
"dateReserved": "2026-01-01T00:00:40.720Z",
"dateUpdated": "2026-03-17T18:21:46.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-21569 (GCVE-0-2026-21569)
Vulnerability from cvelistv5 – Published: 2026-01-28 00:30 – Updated: 2026-01-28 14:49
VLAI
EPSS
VEX
Summary
This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.
This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction.
Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3
See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive).
This vulnerability was reported via our Atlassian (Internal) program.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- XXE (XML External Entity Injection)
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Crowd Data Center |
Affected:
7.1.0 to 7.1.2
Unaffected: 7.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-21569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-28T14:49:16.812896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T14:49:56.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Crowd Data Center",
"vendor": "Atlassian",
"versions": [
{
"status": "affected",
"version": "7.1.0 to 7.1.2"
},
{
"status": "unaffected",
"version": "7.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. \n\t\n\tThis XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user interaction. \n\t\n\tAtlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\t\t\n\t\t* Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to 7.1.3\n\t\t\n\t\t\n\t\n\tSee the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center and Server from the download center (https://www.atlassian.com/software/crowd/download-archive). \n\t\n\tThis vulnerability was reported via our Atlassian (Internal) program."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XXE (XML External Entity Injection)",
"lang": "en",
"type": "XXE (XML External Entity Injection)"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T00:30:00.557Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1712324819"
},
{
"url": "https://jira.atlassian.com/browse/CWD-6453"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2026-21569",
"datePublished": "2026-01-28T00:30:00.557Z",
"dateReserved": "2026-01-01T00:00:40.720Z",
"dateUpdated": "2026-01-28T14:49:56.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-22178 (GCVE-0-2025-22178)
Vulnerability from cvelistv5 – Published: 2025-10-22 16:30 – Updated: 2025-10-22 17:21
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T17:21:18.410947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T17:21:57.848Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the \"Why\" page."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.731Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8647"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22178",
"datePublished": "2025-10-22T16:30:04.731Z",
"dateReserved": "2025-01-01T00:01:27.178Z",
"dateUpdated": "2025-10-22T17:21:57.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22169 (GCVE-0-2025-22169)
Vulnerability from cvelistv5 – Published: 2025-10-22 16:30 – Updated: 2025-10-22 17:24
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T17:23:53.628155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T17:24:43.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.452Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8638"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22169",
"datePublished": "2025-10-22T16:30:04.452Z",
"dateReserved": "2025-01-01T00:01:27.176Z",
"dateUpdated": "2025-10-22T17:24:43.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-22173 (GCVE-0-2025-22173)
Vulnerability from cvelistv5 – Published: 2025-10-22 16:30 – Updated: 2025-10-22 19:12
VLAI
EPSS
VEX
Summary
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper Authorization
- CWE-285 - Improper Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Atlassian | Jira Align |
Unaffected:
< 11.14.0
Affected: >= 11.14.0 Affected: >= 11.14.1 Affected: >= 11.15.0 Affected: >= 11.15.1 Affected: >= 11.16.0 Unaffected: >= 11.16.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-22173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-22T19:12:13.342584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T19:12:18.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jira Align",
"vendor": "Atlassian",
"versions": [
{
"status": "unaffected",
"version": "\u003c 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.0"
},
{
"status": "affected",
"version": "\u003e= 11.14.1"
},
{
"status": "affected",
"version": "\u003e= 11.15.0"
},
{
"status": "affected",
"version": "\u003e= 11.15.1"
},
{
"status": "affected",
"version": "\u003e= 11.16.0"
},
{
"status": "unaffected",
"version": "\u003e= 11.16.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Frank Lycops, NATO Cyber Security Centre"
}
],
"descriptions": [
{
"lang": "en",
"value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authorization",
"lang": "en",
"type": "Improper Authorization"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T16:30:04.376Z",
"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"shortName": "atlassian"
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JIRAALIGN-8642"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
"assignerShortName": "atlassian",
"cveId": "CVE-2025-22173",
"datePublished": "2025-10-22T16:30:04.376Z",
"dateReserved": "2025-01-01T00:01:27.177Z",
"dateUpdated": "2025-10-22T19:12:18.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-201703-0755
Vulnerability from variot - Updated: 2025-11-18 15:18The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. Apache Struts2 Contains a vulnerability that allows the execution of arbitrary code. Apache Struts2 In Jakarta Multipart parser A vulnerability exists in the execution of arbitrary code that could allow the execution of arbitrary code. The attack code for this vulnerability has been released.By processing a request crafted by a remote third party, arbitrary code could be executed with the privileges of the application. Apache Struts 2.3.5 through 2.3.31 and 2.5 through 2.5.10 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03723en_us
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: hpesbhf03723en_us Version: 1
HPESBHF03723 rev.1 - HPE Aruba ClearPass Policy Manager, using Apache Struts, Remote Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2017-03-29 Last Updated: 2017-03-29
Potential Security Impact: Remote: Code Execution
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY A potential security vulnerability has been identified in HPE Aruba ClearPass Policy Manager.
Note: The ClearPass Policy Manager administrative Web interface is affected by the vulnerability. ClearPass Guest, Insight, and Graphite are NOT impacted.
- Aruba ClearPass Policy Manager All versions prior to 6.6.5
BACKGROUND
CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
CVE-2017-5638
9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499
RESOLUTION
HPE Aruba has provided hotfixes for ClearPass 6.6.5, 6.6.4, and 6.5.7. Use one of the following methods to install the appropriate hotfix:
Install the Hotfix Online Using the Software Updates Portal:
-
Open ClearPass Policy Manager and go to Administration - Agents and Software Updates - Software Updates.
-
In the Firmware and Patch Updates area, find the "ClearPass 6.5.7 Hotfix Patch for CVE-2017-5638" or "ClearPass 6.6.4 Hotfix Patch for CVE-2017-5638" patch and click the Download button in its row.
-
Click Install.
-
When the installation is complete and the status is shown as "Needs Restart", proceed to restart ClearPass. After reboot, the status for the patch will be shown as Installed. The ClearPass Policy Manager version number will not change.
Installing the hotfix Offline Using the Patch File from support.arubanetworks.com:
-
Download the "ClearPass 6.5.7 Hotfix Patch for CVE-2017-5638" or "ClearPass 6.6.4 Hotfix Patch for CVE-2017-5638" patch from the Support site.
-
Open the ClearPass Policy Manager Admin UI and go to Administration - Agents and Software Updates - Software Updates.
-
At the bottom of the Firmware and Patch Updates area, click Import Updates and browse to the downloaded patch file. The name and description once imported may differ from the name and remark on the support site as these were adjusted after posting. This is purely a cosmetic discrepancy.
-
Click Install.
-
When the installation is complete and the status is shown as Needs Restart, proceed to restart ClearPass. After reboot, the status for the patch will be shown as Installed. The ClearPass Policy Manager version number will not change.
Workarounds
Restrict access to the Policy Manager Admin Web Interface. This can be accomplished by navigating to Administration - Server Manager - Server Configuration - Server-Name - Network - Restrict Access and only allowing non-public or network management networks.
Note: Please contact HPE Technical Support if any assistance is needed acquiring the software updates.
HISTORY Version:1 (rev.1) - 29 March 2017 Initial release
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBCAAGBQJY3BR/AAoJELXhAxt7SZaiMW8H/0+jWL4Evk+KeqP7aYk1msGp 9ih3F2680VrHVsUbSzul3+svnaWTJUgRe7fUTvsh/Q6bx/Eo86yo8iXGjmzETLtY cTuQrHLySo55Pwua9+89V4e13QkRvQ/UmQPYDMPEk9L7wwU9OF0oCpXHQBuWnw07 mKLZ12HaZqM8vJXgwgJFH77Mf3r5TkGFHsrZ0M+2vvxioJIEfmWV/x4eqtvIy6zS C6CX1M9x4xD442XcFfnH0BHA9RL6LOeYngTPYR7IIycvzpqd8kOWunjs38+IJpFR g49ho/NddeZfDKdJcIdfJ+0f3x2h7FPiVadXu1PzdCckhFHkHmrSlVcRbQZ+1R8= =8ljI -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201703-0755",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "apache struts",
"version": null
},
{
"model": "struts",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.2.3"
},
{
"model": "weblogic server",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "12.2.1.2.0"
},
{
"model": "weblogic server",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "12.2.1.1.0"
},
{
"model": "storage v5030",
"scope": "eq",
"trust": 1.0,
"vendor": "lenovo",
"version": "7.7.1.6"
},
{
"model": "struts",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.5.0"
},
{
"model": "server automation",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "10.0.0"
},
{
"model": "storwize v3500",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": "7.7.1.6"
},
{
"model": "oncommand balance",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "struts",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.3.32"
},
{
"model": "storage v5030",
"scope": "eq",
"trust": 1.0,
"vendor": "lenovo",
"version": "7.8.1.0"
},
{
"model": "weblogic server",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "10.3.6.0.0"
},
{
"model": "server automation",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "10.2.0"
},
{
"model": "storwize v5000",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": "7.8.1.0"
},
{
"model": "storwize v7000",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": "7.8.1.0"
},
{
"model": "struts",
"scope": "lt",
"trust": 1.0,
"vendor": "apache",
"version": "2.5.10.1"
},
{
"model": "storwize v7000",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": "7.7.1.6"
},
{
"model": "clearpass policy manager",
"scope": "lt",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "6.6.5"
},
{
"model": "weblogic server",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "12.1.3.0.0"
},
{
"model": "storwize v5000",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": "7.7.1.6"
},
{
"model": "server automation",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "10.5.0"
},
{
"model": "server automation",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "10.1.0"
},
{
"model": "server automation",
"scope": "eq",
"trust": 1.0,
"vendor": "hp",
"version": "9.1.0"
},
{
"model": "storwize v3500",
"scope": "eq",
"trust": 1.0,
"vendor": "ibm",
"version": "7.8.1.0"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.9,
"vendor": "apache",
"version": "2.3.30"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.9,
"vendor": "apache",
"version": "2.5.8"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.9,
"vendor": "apache",
"version": "2.5.7"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.9,
"vendor": "apache",
"version": "2.5.5"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.9,
"vendor": "apache",
"version": "2.5.2"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.9,
"vendor": "apache",
"version": "2.5.10"
},
{
"model": "struts",
"scope": "lte",
"trust": 0.8,
"vendor": "apache",
"version": "2.3.5 from 2.3.31"
},
{
"model": "struts",
"scope": "lte",
"trust": 0.8,
"vendor": "apache",
"version": "2.5 from 2.5.10"
},
{
"model": "esmpro/servermanager",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "6.10 to 6.16"
},
{
"model": "infoframe relational store",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": "istorage",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "hs series 5.0.5"
},
{
"model": "staroffice x",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "enterprise v4.0"
},
{
"model": "staroffice x",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "enterprise v5.0"
},
{
"model": "staroffice x",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "enterprise v5.1"
},
{
"model": "staroffice x",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "standard v4.0"
},
{
"model": "staroffice x",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "standard v5.0"
},
{
"model": "staroffice x",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "standard v5.1"
},
{
"model": "webotx developer",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "\"(with developers studio) v9.3\""
},
{
"model": "webotx developer",
"scope": "eq",
"trust": 0.8,
"vendor": "nec",
"version": "\"(with developers studio) v9.4\""
},
{
"model": "hirdb",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "server version 9"
},
{
"model": "hirdb control manager",
"scope": "eq",
"trust": 0.8,
"vendor": "hitachi",
"version": "- server version 9"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.5.4"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.5.3"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.5.6"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "2.5.9"
},
{
"model": "vrealize operations manager",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.0"
},
{
"model": "vrealize hyperic",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "5.0"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.5"
},
{
"model": "vcenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.0"
},
{
"model": "horizon desktop as-a-service platform",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "7.0"
},
{
"model": "horizon desktop as-a-service platform",
"scope": "eq",
"trust": 0.3,
"vendor": "vmware",
"version": "6.0"
},
{
"model": "webcenter sites",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "11.1.18.0"
},
{
"model": "webcenter sites",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "12.2.1.2.0"
},
{
"model": "webcenter sites",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "12.2.1.1.0"
},
{
"model": "webcenter sites",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "12.2.1.0.0"
},
{
"model": "sterling selling and fulfillment foundation",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.5"
},
{
"model": "sterling selling and fulfillment foundation",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.4"
},
{
"model": "sterling selling and fulfillment foundation",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.2.1"
},
{
"model": "sterling selling and fulfillment foundation",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.2"
},
{
"model": "sterling selling and fulfillment foundation",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.1"
},
{
"model": "sterling selling and fulfillment foundation",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.3.0"
},
{
"model": "connections",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.5"
},
{
"model": "connections",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "5.0"
},
{
"model": "connections",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.5"
},
{
"model": "connections",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.0"
},
{
"model": "smsgw v100r003c01",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "smsgw v100r002c11",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "smsgw v100r002c01",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "secospace antiddos8030 v100r001c00",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "imanager neteco v600r007c91",
"scope": "eq",
"trust": 0.3,
"vendor": "huawei",
"version": "6000"
},
{
"model": "imanager neteco v600r007c90",
"scope": "eq",
"trust": 0.3,
"vendor": "huawei",
"version": "6000"
},
{
"model": "imanager neteco v600r007c80",
"scope": "eq",
"trust": 0.3,
"vendor": "huawei",
"version": "6000"
},
{
"model": "imanager neteco v600r008c20",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "imanager neteco v600r008c10",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "imanager neteco v600r008c00",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "imanager neteco v600r007c60spc100",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "imanager neteco v600r007c50",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "imanager neteco v600r007c11",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "espace ecs v300r001c00",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "espace ecs v200r003c10",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "espace ecs v200r003c00",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "espace ecs v200r002c00",
"scope": null,
"trust": 0.3,
"vendor": "huawei",
"version": null
},
{
"model": "universal cmdb foundation software cup5",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.22"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.16"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.15"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.14"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.13"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.12"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.10"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "9.1"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.50"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.20"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.10"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.02"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.01"
},
{
"model": "server automation",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.00"
},
{
"model": "virtualized voice browser",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unity connection",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified sip proxy software",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified intelligent contact management enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified intelligence center",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified contact center express",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified contact center enterprise live data server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "-0"
},
{
"model": "unified contact center enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified communications manager session management edition",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified communications manager im \u0026 presence service",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "unified communications manager",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": null
},
{
"model": "socialminer",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "prime service catalog appliance and virtual appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "prime license manager",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "packaged contact center enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "mediasense",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "identity services engine",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "hosted collaboration solution for contact center",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "hosted collaboration mediation fulfillment",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "finesse",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "emergency responder",
"scope": null,
"trust": 0.3,
"vendor": "cisco",
"version": null
},
{
"model": "hipchat server",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.0"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.11"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.10.1"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9.5"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9.4"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9.3"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9.2"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9.1"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.8.8"
},
{
"model": "crowd",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.8.3"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.15"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.12"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.11"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.10"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.1"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.12.3.1"
},
{
"model": "bamboo",
"scope": "eq",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.11.4.1"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.31"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.28"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.24"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.5"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.5.1"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.5"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.8"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.7"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.29"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.20"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.16"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.15"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.14"
},
{
"model": "struts",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.12"
},
{
"model": "vcenter server 6.5b",
"scope": "ne",
"trust": 0.3,
"vendor": "vmware",
"version": null
},
{
"model": "sterling selling and fulfillment foundation 9.5.0-sfp2",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "sterling selling and fulfillment foundation 9.4.0-sfp3",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "sterling selling and fulfillment foundation 9.3.0-sfp5",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": null
},
{
"model": "sterling selling and fulfillment foundation sfp6",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "9.2.1-"
},
{
"model": "sterling selling and fulfillment foundation sfp6",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "9.2.0-"
},
{
"model": "sterling selling and fulfillment foundation sfp6",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "9.1.0-"
},
{
"model": "virtualized voice browser su1",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "unity connection",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "12.0"
},
{
"model": "unity connection",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "unity connection",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.0"
},
{
"model": "unified sip proxy software",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.1"
},
{
"model": "unified intelligent contact management enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5(1)"
},
{
"model": "unified intelligent contact management enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.0(2)"
},
{
"model": "unified intelligent contact management enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.5(3)"
},
{
"model": "unified intelligent contact management enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.0(2)"
},
{
"model": "unified intelligence center es03",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5(1)"
},
{
"model": "unified contact center express su1",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "unified contact center enterprise live data server",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "-11.5(1)"
},
{
"model": "unified contact center enterprise live data server",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "-11.0(2)"
},
{
"model": "unified contact center enterprise live data server",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "-10.5(3)"
},
{
"model": "unified contact center enterprise live data server",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "-10.0(2)"
},
{
"model": "unified contact center enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5(1)"
},
{
"model": "unified contact center enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.0(2)"
},
{
"model": "unified contact center enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.5(3)"
},
{
"model": "unified contact center enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.0(2)"
},
{
"model": "socialminer su1",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "prime license manager 11.5 su1a",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": null
},
{
"model": "mediasense",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "hosted collaboration solution for contact center",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5(1)"
},
{
"model": "hosted collaboration solution for contact center",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.0(2)"
},
{
"model": "hosted collaboration solution for contact center",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.5(3)"
},
{
"model": "hosted collaboration solution for contact center",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "10.0(2)"
},
{
"model": "finesse es2",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "11.5"
},
{
"model": "hipchat server",
"scope": "ne",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.2.2"
},
{
"model": "crowd",
"scope": "ne",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.11.1"
},
{
"model": "crowd",
"scope": "ne",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.10.3"
},
{
"model": "crowd",
"scope": "ne",
"trust": 0.3,
"vendor": "atlassian",
"version": "2.9.7"
},
{
"model": "bamboo",
"scope": "ne",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.15.3"
},
{
"model": "bamboo",
"scope": "ne",
"trust": 0.3,
"vendor": "atlassian",
"version": "5.14.5"
},
{
"model": "struts",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "2.5.10.1"
},
{
"model": "struts",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "2.3.32"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "BID",
"id": "96729"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apache:struts",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:esmpro_servermanager",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:infoframe_relational_store",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:nec:istorage",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:staroffice_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:nec:webotx_developer",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hirdb",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hitachi:hirdb_control_manager",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nike Zheng",
"sources": [
{
"db": "BID",
"id": "96729"
}
],
"trust": 0.3
},
"cve": "CVE-2017-5638",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-5638",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 10.0,
"collateralDamagePotential": "NONE",
"confidentialityImpact": "COMPLETE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.7,
"exploitability": "HIGH",
"exploitabilityScore": 10.0,
"id": "CVE-2017-5638",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "OFFICIAL FIX",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "HIGH",
"trust": 1.6,
"userInteractionRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-5638",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-5638",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-5638",
"trust": 1.6,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2017-5638",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2017-5638",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-5638",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201703-152",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2017-5638",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. Apache Struts2 Contains a vulnerability that allows the execution of arbitrary code. Apache Struts2 In Jakarta Multipart parser A vulnerability exists in the execution of arbitrary code that could allow the execution of arbitrary code. The attack code for this vulnerability has been released.By processing a request crafted by a remote third party, arbitrary code could be executed with the privileges of the application. \nApache Struts 2.3.5 through 2.3.31 and 2.5 through 2.5.10 are vulnerable. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03723en_us\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: hpesbhf03723en_us\nVersion: 1\n\nHPESBHF03723 rev.1 - HPE Aruba ClearPass Policy Manager, using Apache Struts,\nRemote Code Execution\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2017-03-29\nLast Updated: 2017-03-29\n\nPotential Security Impact: Remote: Code Execution\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA potential security vulnerability has been identified in HPE Aruba ClearPass\nPolicy Manager. \n\n**Note:** The ClearPass Policy Manager administrative Web interface is\naffected by the vulnerability. ClearPass Guest, Insight, and Graphite are NOT\nimpacted. \n\n - Aruba ClearPass Policy Manager All versions prior to 6.6.5\n\nBACKGROUND\n\n CVSS Base Metrics\n =================\n Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n CVE-2017-5638\n 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)\n\n Information on CVSS is documented in\n HPE Customer Notice HPSN-2008-002 here:\n\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499\n\nRESOLUTION\n\nHPE Aruba has provided hotfixes for ClearPass 6.6.5, 6.6.4, and 6.5.7. Use\none of the following methods to install the appropriate hotfix:\n\nInstall the Hotfix Online Using the Software Updates Portal:\n \n 1. Open ClearPass Policy Manager and go to Administration - Agents and\nSoftware\n Updates - Software Updates. \n \n 2. In the Firmware and Patch Updates area, find the \"ClearPass 6.5.7\nHotfix\n Patch for CVE-2017-5638\" or \"ClearPass 6.6.4 Hotfix Patch for\nCVE-2017-5638\"\n patch and click the Download button in its row. \n \n 3. Click Install. \n \n 4. When the installation is complete and the status is shown as \"Needs\n Restart\", proceed to restart ClearPass. After reboot, the status for the\n patch will be shown as Installed. The ClearPass Policy Manager version\n number will not change. \n\n \nInstalling the hotfix Offline Using the Patch File from\nsupport.arubanetworks.com:\n \n 1. Download the \"ClearPass 6.5.7 Hotfix Patch for CVE-2017-5638\" or\n \"ClearPass 6.6.4 Hotfix Patch for CVE-2017-5638\" patch from the Support\nsite. \n \n 2. Open the ClearPass Policy Manager Admin UI and go to Administration -\n Agents and Software Updates - Software Updates. \n 3. At the bottom of the Firmware and Patch Updates area, click Import\nUpdates\n and browse to the downloaded patch file. The name and description once\n imported may differ from the name and remark on the support site\n as these were adjusted after posting. This is purely a cosmetic\ndiscrepancy. \n \n 4. Click Install. \n \n 5. When the installation is complete and the status is shown as Needs\nRestart,\n proceed to restart ClearPass. After reboot, the status for the patch will\n be shown as Installed. The ClearPass Policy Manager version number will\n not change. \n\n\nWorkarounds\n- ----------- \nRestrict access to the Policy Manager Admin Web Interface. This can be\naccomplished by navigating to Administration - Server Manager -\nServer Configuration - Server-Name - Network - Restrict Access and\nonly allowing non-public or network management networks. \n\n**Note:** Please contact HPE Technical Support if any assistance is needed\nacquiring the software updates. \n\nHISTORY\nVersion:1 (rev.1) - 29 March 2017 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability for any HPE supported\nproduct:\n Web form: https://www.hpe.com/info/report-security-vulnerability\n Email: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBCAAGBQJY3BR/AAoJELXhAxt7SZaiMW8H/0+jWL4Evk+KeqP7aYk1msGp\n9ih3F2680VrHVsUbSzul3+svnaWTJUgRe7fUTvsh/Q6bx/Eo86yo8iXGjmzETLtY\ncTuQrHLySo55Pwua9+89V4e13QkRvQ/UmQPYDMPEk9L7wwU9OF0oCpXHQBuWnw07\nmKLZ12HaZqM8vJXgwgJFH77Mf3r5TkGFHsrZ0M+2vvxioJIEfmWV/x4eqtvIy6zS\nC6CX1M9x4xD442XcFfnH0BHA9RL6LOeYngTPYR7IIycvzpqd8kOWunjs38+IJpFR\ng49ho/NddeZfDKdJcIdfJ+0f3x2h7FPiVadXu1PzdCckhFHkHmrSlVcRbQZ+1R8=\n=8ljI\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-5638"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "BID",
"id": "96729"
},
{
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"db": "PACKETSTORM",
"id": "142055"
},
{
"db": "PACKETSTORM",
"id": "141863"
}
],
"trust": 3.6
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.kb.cert.org/vuls/id/834067",
"trust": 1.6,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=41570",
"trust": 0.2,
"type": "exploit"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "VULMON",
"id": "CVE-2017-5638"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-5638",
"trust": 4.6
},
{
"db": "CERT/CC",
"id": "VU#834067",
"trust": 4.3
},
{
"db": "EXPLOIT-DB",
"id": "41570",
"trust": 3.2
},
{
"db": "BID",
"id": "96729",
"trust": 1.9
},
{
"db": "EXPLOIT-DB",
"id": "41614",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1037973",
"trust": 1.6
},
{
"db": "LENOVO",
"id": "LEN-14200",
"trust": 1.6
},
{
"db": "PACKETSTORM",
"id": "141494",
"trust": 1.6
},
{
"db": "JVN",
"id": "JVNVU93610402",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2017-5638",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "142055",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "141863",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"db": "BID",
"id": "96729"
},
{
"db": "PACKETSTORM",
"id": "142055"
},
{
"db": "PACKETSTORM",
"id": "141863"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"id": "VAR-201703-0755",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.5
},
"last_update_date": "2025-11-18T15:18:06.225000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "WW-3025",
"trust": 0.8,
"url": "https://issues.apache.org/jira/browse/WW-3025"
},
{
"title": "Alternate Libraries",
"trust": 0.8,
"url": "https://cwiki.apache.org/confluence/display/WW/File+Upload#FileUpload-AlternateLibraries"
},
{
"title": "S2-045: Possible Remote Code Execution when performing file upload based on Jakarta Multipart parser.",
"trust": 0.8,
"url": "https://struts.apache.org/docs/s2-045.html"
},
{
"title": "Uses default error key if specified key doesn\u0027t exist (3523064)",
"trust": 0.8,
"url": "https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a"
},
{
"title": "Uses default error key if specified key doesn\u0027t exist (6b8272c)",
"trust": 0.8,
"url": "https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228"
},
{
"title": "Content-Type: Malicious - New Apache Struts2 0-day Under Attack",
"trust": 0.8,
"url": "http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html"
},
{
"title": "hitachi-sec-2017-110",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-110/index.html"
},
{
"title": "NV17-013",
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv17-013.html"
},
{
"title": "hitachi-sec-2017-110",
"trust": 0.8,
"url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-110/index.html"
},
{
"title": "Veritas NetBackup: \u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u8106\u5f31\u6027(CVE-2017-5638) (2017\u5e749\u67081\u65e5)",
"trust": 0.8,
"url": "http://www.fujitsu.com/jp/products/software/resources/condition/security/products-fujitsu/solution/veritas201712.html"
},
{
"title": "Apache Struts 2 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67948"
},
{
"title": "Cisco: Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20170310-struts2"
},
{
"title": "CVE-2017-5638",
"trust": 0.1,
"url": "https://github.com/readloud/CVE-2017-5638 "
},
{
"title": "cve-2017-5638",
"trust": 0.1,
"url": "https://github.com/jrrdev/cve-2017-5638 "
},
{
"title": "apache-struts-v2-CVE-2017-5638",
"trust": 0.1,
"url": "https://github.com/cafnet/apache-struts-v2-CVE-2017-5638 "
},
{
"title": "struts-vulnerability-demo",
"trust": 0.1,
"url": "https://github.com/corpbob/struts-vulnerability-demo "
},
{
"title": "struts2_cve-2017-5638",
"trust": 0.1,
"url": "https://github.com/m3ssap0/struts2_cve-2017-5638 "
},
{
"title": "struts-rce-cve-2017-5638",
"trust": 0.1,
"url": "https://github.com/riyazwalikar/struts-rce-cve-2017-5638 "
},
{
"title": "equifax-data-breach",
"trust": 0.1,
"url": "https://github.com/raul23/equifax-data-breach "
},
{
"title": "CVE-2017-5638",
"trust": 0.1,
"url": "https://github.com/colorblindpentester/CVE-2017-5638 "
},
{
"title": "struts2-rce",
"trust": 0.1,
"url": "https://github.com/sotudeko/struts2-rce "
},
{
"title": "vuln-struts2-vm",
"trust": 0.1,
"url": "https://github.com/evolvesecurity/vuln-struts2-vm "
},
{
"title": "Apache-Struts-2-CVE-2017-5638-Exploit",
"trust": 0.1,
"url": "https://github.com/dock0d1/Apache-Struts-2-CVE-2017-5638-Exploit "
},
{
"title": "struts2-rce",
"trust": 0.1,
"url": "https://github.com/rjd3/struts2-rce "
},
{
"title": "Struts2-045-RCE",
"trust": 0.1,
"url": "https://github.com/RayScri/Struts2-045-RCE "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-755",
"trust": 1.0
},
{
"problemtype": "CWE-20",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.5,
"url": "https://cwiki.apache.org/confluence/display/ww/s2-045"
},
{
"trust": 3.2,
"url": "http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html"
},
{
"trust": 3.2,
"url": "https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/"
},
{
"trust": 3.2,
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/"
},
{
"trust": 2.7,
"url": "https://www.kb.cert.org/vuls/id/834067"
},
{
"trust": 1.9,
"url": "https://github.com/rapid7/metasploit-framework/issues/8064"
},
{
"trust": 1.6,
"url": "https://github.com/rapid7/metasploit-framework/issues/8064 "
},
{
"trust": 1.6,
"url": "https://www.exploit-db.com/exploits/41570/"
},
{
"trust": 1.6,
"url": "https://cwe.mitre.org/data/definitions/94.html"
},
{
"trust": 1.6,
"url": "http://www.arubanetworks.com/assets/alert/aruba-psa-2017-002.txt"
},
{
"trust": 1.6,
"url": "https://cwiki.apache.org/confluence/display/ww/s2-046"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/96729"
},
{
"trust": 1.6,
"url": "https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/"
},
{
"trust": 1.6,
"url": "https://www.symantec.com/security-center/network-protection-security-advisories/sa145"
},
{
"trust": 1.6,
"url": "https://exploit-db.com/exploits/41570"
},
{
"trust": 1.6,
"url": "https://packetstormsecurity.com/files/141494/s2-45-poc.py.txt"
},
{
"trust": 1.6,
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"trust": 1.6,
"url": "https://github.com/mazen160/struts-pwn"
},
{
"trust": 1.6,
"url": "https://support.lenovo.com/us/en/product_security/len-14200"
},
{
"trust": 1.6,
"url": "https://struts.apache.org/docs/s2-046.html"
},
{
"trust": 1.6,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbgn03733en_us"
},
{
"trust": 1.6,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03723en_us"
},
{
"trust": 1.6,
"url": "https://security.netapp.com/advisory/ntap-20170310-0001/"
},
{
"trust": 1.6,
"url": "https://twitter.com/theog150/status/841146956135124993"
},
{
"trust": 1.6,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbgn03749en_us"
},
{
"trust": 1.6,
"url": "https://www.exploit-db.com/exploits/41614/"
},
{
"trust": 1.6,
"url": "https://struts.apache.org/docs/s2-045.html"
},
{
"trust": 1.6,
"url": "http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id/1037973"
},
{
"trust": 1.6,
"url": "https://isc.sans.edu/diary/22169"
},
{
"trust": 1.0,
"url": "https://git1-us-west.apache.org/repos/asf?p=struts.git%3ba=commit%3bh=6b8272ce47160036ed120a48345d9aa884477228"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3cannounce.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3cannounce.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2017-5638"
},
{
"trust": 1.0,
"url": "https://git1-us-west.apache.org/repos/asf?p=struts.git%3ba=commit%3bh=352306493971e7d5a756d61780d57a76eb1f519a"
},
{
"trust": 1.0,
"url": "https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3cannounce.apache.org%3e"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5638"
},
{
"trust": 0.8,
"url": "https://www.ipa.go.jp/security/ciadr/vul/20170308-struts.html"
},
{
"trust": 0.8,
"url": "https://www.jpcert.or.jp/at/2017/at170009.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu93610402/index.html"
},
{
"trust": 0.8,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-5638"
},
{
"trust": 0.6,
"url": "https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3cannounce.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3cannounce.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3cannounce.apache.org%3e"
},
{
"trust": 0.6,
"url": "http-vuln-cve2017-5638.html"
},
{
"trust": 0.6,
"url": "https://nmap.org/nsedoc/scripts/"
},
{
"trust": 0.6,
"url": "https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a"
},
{
"trust": 0.6,
"url": "https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170316-01-struts2-cn"
},
{
"trust": 0.4,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-hpesbgn03733en_us"
},
{
"trust": 0.3,
"url": "http://www.apache.org/"
},
{
"trust": 0.3,
"url": "http://struts.apache.org/"
},
{
"trust": 0.3,
"url": "https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-03-10-876857850.html"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1430326"
},
{
"trust": 0.3,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170310-struts2"
},
{
"trust": 0.3,
"url": "https://confluence.atlassian.com/crowd/crowd-security-advisory-2017-03-10-876857916.html"
},
{
"trust": 0.3,
"url": "https://confluence.atlassian.com/display/hc/hipchat+server+security+advisory+2017-03-09"
},
{
"trust": 0.3,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-hpesbgn03749en_us"
},
{
"trust": 0.3,
"url": "http://www.huawei.com/en/psirt/security-notices/2017/huawei-sn-20170313-01-struts2-en"
},
{
"trust": 0.3,
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg22000444"
},
{
"trust": 0.3,
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg22001736"
},
{
"trust": 0.3,
"url": "http://www.vmware.com/security/advisories/vmsa-2017-0004.html"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-5638"
},
{
"trust": 0.2,
"url": "http://www.hpe.com/support/security_bulletin_archive"
},
{
"trust": 0.2,
"url": "https://www.hpe.com/info/report-security-vulnerability"
},
{
"trust": 0.2,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499"
},
{
"trust": 0.2,
"url": "http://www.hpe.com/support/subscriber_choice"
},
{
"trust": 0.1,
"url": "https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facets"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-hpesbhf03723en_us"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "BID",
"id": "96729"
},
{
"db": "PACKETSTORM",
"id": "142055"
},
{
"db": "PACKETSTORM",
"id": "141863"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"db": "BID",
"id": "96729"
},
{
"db": "PACKETSTORM",
"id": "142055"
},
{
"db": "PACKETSTORM",
"id": "141863"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-03-14T00:00:00",
"db": "CERT/CC",
"id": "VU#834067"
},
{
"date": "2017-03-14T00:00:00",
"db": "CERT/CC",
"id": "VU#834067"
},
{
"date": "2017-03-11T00:00:00",
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"date": "2017-03-06T00:00:00",
"db": "BID",
"id": "96729"
},
{
"date": "2017-04-07T18:18:00",
"db": "PACKETSTORM",
"id": "142055"
},
{
"date": "2017-03-30T16:04:25",
"db": "PACKETSTORM",
"id": "141863"
},
{
"date": "2017-03-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"date": "2017-03-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"date": "2017-03-11T02:59:00.150000",
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-03-14T00:00:00",
"db": "CERT/CC",
"id": "VU#834067"
},
{
"date": "2017-03-14T00:00:00",
"db": "CERT/CC",
"id": "VU#834067"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2017-5638"
},
{
"date": "2017-05-26T07:00:00",
"db": "BID",
"id": "96729"
},
{
"date": "2021-02-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201703-152"
},
{
"date": "2017-10-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-001621"
},
{
"date": "2025-10-22T00:16:06.887000",
"db": "NVD",
"id": "CVE-2017-5638"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Struts 2 is vulnerable to remote code execution",
"sources": [
{
"db": "CERT/CC",
"id": "VU#834067"
},
{
"db": "CERT/CC",
"id": "VU#834067"
}
],
"trust": 1.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input Validation Error",
"sources": [
{
"db": "BID",
"id": "96729"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-152"
}
],
"trust": 0.9
}
}
VAR-202206-0004
Vulnerability from variot - Updated: 2025-11-18 14:47In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. (DoS) It may be in a state. Atlassian Confluence Server is a server version of Atlassian's collaboration software with enterprise knowledge management functions and support for building enterprise WiKi. The affected versions are from 1.3.0 prior to 7.4.17, from 7.13.0 prior to 7.13.7, from 7.14.0 prior to 7.14.3, from 7.15.0 prior to 7.15.2, from 7.16.0 prior to 7.16.4, from 7.17.0 prior to 7.17.4, and from 7.18.0 prior to 7.18.1
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202206-0004",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "confluence server",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.13.0"
},
{
"model": "confluence server",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.15.0"
},
{
"model": "confluence data center",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.16.4"
},
{
"model": "confluence data center",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.4.17"
},
{
"model": "confluence data center",
"scope": "eq",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.18.0"
},
{
"model": "confluence data center",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.13.7"
},
{
"model": "confluence data center",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.17.4"
},
{
"model": "confluence data center",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.15.2"
},
{
"model": "confluence server",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "1.3"
},
{
"model": "confluence server",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.14.0"
},
{
"model": "confluence data center",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.16.0"
},
{
"model": "confluence server",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.17.0"
},
{
"model": "confluence data center",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.13.0"
},
{
"model": "confluence server",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.14.3"
},
{
"model": "confluence data center",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.15.0"
},
{
"model": "confluence server",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.17.4"
},
{
"model": "confluence data center",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.14.0"
},
{
"model": "confluence data center",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "1.3"
},
{
"model": "confluence data center",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.17.0"
},
{
"model": "confluence server",
"scope": "eq",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.18.0"
},
{
"model": "confluence server",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.16.4"
},
{
"model": "confluence server",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.4.17"
},
{
"model": "confluence data center",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.14.3"
},
{
"model": "confluence server",
"scope": "gte",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.16.0"
},
{
"model": "confluence server",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.13.7"
},
{
"model": "confluence server",
"scope": "lt",
"trust": 1.0,
"vendor": "atlassian",
"version": "7.15.2"
},
{
"model": "confluence server",
"scope": null,
"trust": 0.8,
"vendor": "atlassian",
"version": null
},
{
"model": "confluence data center",
"scope": null,
"trust": 0.8,
"vendor": "atlassian",
"version": null
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "1.3.0,\u003c7.4.17"
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "7.13.0,\u003c7.13.7"
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "7.14.0,\u003c7.14.3"
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "7.15.0,\u003c7.15.2"
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "7.16.0,\u003c7.16.4"
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "7.17.0,\u003c7.17.4"
},
{
"model": "confluence server and data center",
"scope": "eq",
"trust": 0.6,
"vendor": "atlassian",
"version": "7.18.0,\u003c7.18.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "h3v0x",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
}
],
"trust": 0.6
},
"cve": "CVE-2022-26134",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2022-26134",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2022-50013",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2022-26134",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-26134",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2022-26134",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2022-26134",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2022-26134",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2022-50013",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202206-442",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2022-26134",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"db": "VULMON",
"id": "CVE-2022-26134"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. (DoS) It may be in a state. Atlassian Confluence Server is a server version of Atlassian\u0027s collaboration software with enterprise knowledge management functions and support for building enterprise WiKi. The affected versions are from 1.3.0 prior to 7.4.17, from 7.13.0 prior to 7.13.7, from 7.14.0 prior to 7.14.3, from 7.15.0 prior to 7.15.2, from 7.16.0 prior to 7.16.4, from 7.17.0 prior to 7.17.4, and from 7.18.0 prior to 7.18.1",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-26134"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"db": "VULMON",
"id": "CVE-2022-26134"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-26134",
"trust": 3.9
},
{
"db": "PACKETSTORM",
"id": "167432",
"trust": 2.4
},
{
"db": "PACKETSTORM",
"id": "167430",
"trust": 2.4
},
{
"db": "PACKETSTORM",
"id": "167449",
"trust": 2.4
},
{
"db": "PACKETSTORM",
"id": "167431",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2022-50013",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022060301",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "50952",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2022060031",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202206-442",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-26134",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"db": "VULMON",
"id": "CVE-2022-26134"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"id": "VAR-202206-0004",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
}
]
},
"last_update_date": "2025-11-18T14:47:07.462000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Command execution vulnerability in Atlassian Confluence Server and Data Center",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/337616"
},
{
"title": "Atlassian Confluence Server Repair measures for injecting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=196250"
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/skhalsa-sigsci/CVE-2022-26134-LAB "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/badboy-sft/CVE-2022-26134 "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/CyberDonkyx0/CVE-2022-26134 "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/AmoloHT/CVE-2022-26134 "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"db": "VULMON",
"id": "CVE-2022-26134"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-917",
"trust": 1.0
},
{
"problemtype": "Improper invalidation of special elements used to represent language constructs (CWE-917) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://packetstormsecurity.com/files/167430/confluence-ognl-injection-remote-code-execution.html"
},
{
"trust": 2.4,
"url": "https://jira.atlassian.com/browse/confserver-79016"
},
{
"trust": 2.4,
"url": "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/167431/through-the-wire-cve-2022-26134-confluence-proof-of-concept.html"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/167449/atlassian-confluence-namespace-ognl-injection.html"
},
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/167432/confluence-ognl-injection-proof-of-concept.html"
},
{
"trust": 1.0,
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2022-26134"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-26134"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022060301"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-26134/"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022060031"
},
{
"trust": 0.6,
"url": "https://www.exploit-db.com/exploits/50952"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"db": "VULMON",
"id": "CVE-2022-26134"
},
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"date": "2022-06-03T00:00:00",
"db": "VULMON",
"id": "CVE-2022-26134"
},
{
"date": "2022-06-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-442"
},
{
"date": "2023-08-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"date": "2022-06-03T22:15:07.717000",
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-07-07T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-50013"
},
{
"date": "2023-08-08T00:00:00",
"db": "VULMON",
"id": "CVE-2022-26134"
},
{
"date": "2022-07-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202206-442"
},
{
"date": "2023-08-18T08:23:00",
"db": "JVNDB",
"id": "JVNDB-2022-011115"
},
{
"date": "2025-10-24T13:38:30.590000",
"db": "NVD",
"id": "CVE-2022-26134"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Atlassian\u00a0 of \u00a0Confluence\u00a0Data\u00a0Center\u00a0 and \u00a0Confluence\u00a0Server\u00a0 Vulnerability in improper invalidation of special elements used to represent language construction in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-011115"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202206-442"
}
],
"trust": 0.6
}
}