Vulnerabilities in Atlassian

399 results
Vexday analysis

Com 13 CVEs confirmadas em exploração ativa pelo CISA KEV de um total de 399 catalogadas, a taxa de exploração do portfólio Atlassian é 7,2 vezes acima da média geral do catálogo, o que indica atenção elevada por parte de agentes maliciosos a vulnerabilidades nesse ecossistema. O tipo de falha mais recorrente é CWE-863 (Autorização Incorreta), sugerindo deficiências estruturais em controles de acesso que tendem a ter impacto amplo em ambientes colaborativos. A CVE mais crítica em exploração ativa, CVE-2021-26084, apresenta EPSS máximo de 1,0 — indicador de probabilidade praticamente certa de exploração em campo —, o que a coloca como prioridade absoluta de remediação para qualquer organização que ainda não tenha aplicado os patches correspondentes. Com 19 vulnerabilidades com PoC pública e 22 de severidade crítica no portfólio total, a superfície de risco permanece significativa e exige monitoramento contínuo.

CVE-2020-14192—Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabiliEPSS 0.9%CVE-2017-18090—Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers toEPSS 0.9%CVE-2020-4028—Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in somEPSS 0.9%CVE-2018-13388—The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JaEPSS 0.9%CVE-2017-18093—Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackeEPSS 0.9%CVE-2017-18091—The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allowsEPSS 0.9%CVE-2017-14587—The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitraryEPSS 0.9%CVE-2021-41304—Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroEPSS 0.8%CVE-2020-14180—Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to EPSS 0.8%CVE-2018-20826—The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missEPSS 0.8%CVE-2020-29451—Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vEPSS 0.8%CVE-2021-41313—Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configuratEPSS 0.8%CVE-2021-43955—The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain infEPSS 0.8%CVE-2018-13394—The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated toEPSS 0.8%CVE-2021-41311HIGHAffected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access rEPSS 0.8%CVE-2021-43950—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conEPSS 0.8%CVE-2021-43948—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privEPSS 0.8%CVE-2020-14170—Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netwEPSS 0.8%CVE-2017-9508—Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via aEPSS 0.8%CVE-2017-18103—The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the EPSS 0.8%