Multiple vulnerabilities in Atlassian Products

Published: 2022-07-29 | Updated: 2023-01-27

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2022-26136 CVE-2022-26137 CVE-2022-26133
CWE-ID	CWE-79 CWE-345 CWE-502
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software Subscribe	Bamboo Server and Data Center Server applications / Other server solutions Bitbucket Data Center Server applications / Other server solutions Confluence Data Center Server applications / Other server solutions Crowd Data Center Server applications / Other server solutions Jira Service Management Server Server applications / Other server solutions Jira Software Client/Desktop applications / Other client software Atlassian Crucible Client/Desktop applications / Office applications Atlassian Fisheye Client/Desktop applications / Office applications
Vendor	Atlassian

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Cross-site scripting

EUVDB-ID: #VU65891

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26136

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Servlet Filter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Bamboo Server and Data Center: 7.2.0 - 8.2.3

Bitbucket Data Center: 7.6.0 - 8.1.0

Confluence Data Center: 7.4.0 - 7.18.0

Crowd Data Center: 4.3.0 - 5.0.0

Jira Software: 8.13.0 - 8.22.3

Jira Service Management Server: 4.13.0 - 4.22.5

Atlassian Crucible: 4.8.0 - 4.8.9

Atlassian Fisheye: 4.8.0 - 4.8.9

External links

http://jira.atlassian.com/browse/CWD-5815
http://jira.atlassian.com/browse/FE-7410
http://jira.atlassian.com/browse/JRASERVER-73897
http://jira.atlassian.com/browse/BAM-21795
http://jira.atlassian.com/browse/JSDSERVER-11863
http://jira.atlassian.com/browse/CONFSERVER-79476
http://jira.atlassian.com/browse/CRUC-8541
http://jira.atlassian.com/browse/BSERV-13370

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficient verification of data authenticity

EUVDB-ID: #VU65892

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26137

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to origin validation error when processing HTTP requests, related to cross-origin sharing (CORS) in the Servlet Filter. A remote attacker can trick the victim to follow a specially crafted link and access the vulnerable application with the victim’s permissions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Bamboo Server and Data Center: 7.2.0 - 8.2.3

Bitbucket Data Center: 7.6.0 - 8.1.0

Confluence Data Center: 7.4.0 - 7.18.0

Crowd Data Center: 4.3.0 - 5.0.0

Jira Software: 8.13.0 - 8.22.3

Jira Service Management Server: 4.13.0 - 4.22.5

Atlassian Crucible: 4.8.0 - 4.8.9

Atlassian Fisheye: 4.8.0 - 4.8.9

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Deserialization of Untrusted Data

EUVDB-ID: #VU66555

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-26133

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the SharedSecretClusterAuthenticator. A remote non-authenticated attacker can send specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Bitbucket Data Center: 7.6.0 - 7.20.1

Confluence Data Center: 7.4.0 - 7.18.0

External links

http://jira.atlassian.com/browse/BSERV-13173
http://confluence.atlassian.com/security/multiple-products-security-advisory-hazelcast-vulnerable-to-remote-code-execution-cve-2016-10750-1116292387.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.