Atlassian patches multple products, fixes critical dependency flaws in Confluence and Crowd
Take action: If you are running self-hosted Atlassian Confluence or Crowd, plan a quick update. The products carry critical flaw in the underlying Tomcat, and if they are exposed on the internet they will be hacked. Previous Confluence flaws have already been used as an attack vector multiple times - even to hack a hacker group.
Learn More
Atlassian has released a security update addressing multiple critical and high-severity vulnerabilities across their product suite. The update covers twelve significant vulnerabilities, including five critical-severity and seven high-severity issues discovered through their Bug Bounty program, penetration testing processes, and third-party library scans.
Critical Vulnerabilities:
- CVE-2024-50379 (CVSS score 9.8) - Remote Code Execution vulnerability in Apache Tomcat Catalina, affecting Confluence and Crowd Data Center and Server
- CVE-2024-56337 (CVSS score 9.8) - Remote Code Execution vulnerability in Apache Tomcat Catalina, affecting Confluence and Crowd Data Center and Server
- CVE-2024-52316 (CVSS score 9.8) - Broken Authentication & Session Management vulnerability in Apache Tomcat Catalina, affecting Crowd Data Center and Server
High Severity Vulnerabilities:
- CVE-2024-7254 (CVSS score 8.7) - Denial of Service vulnerability in Google Protobuf Java affecting Bamboo and Jira Data Center and Server
- CVE-2024-47072 (CVSS score 7.5) - Denial of Service vulnerability in XStream affecting Bamboo Data Center and Server
- CVE-2024-47561 (CVSS score 7.3) - Remote Code Execution vulnerability in Apache Avro affecting Bitbucket Data Center and Server
- CVE-2022-25927 (CVSS score 7.5) - Denial of Service vulnerability in ua-parser.js affecting Crowd Data Center
Atlassian has released patched versions for all affected products:
- Bamboo: 10.2.1 (LTS) for Data Center
- Bitbucket: 8.19.11 to 8.19.15 (LTS) for Data Center
- Confluence: 9.2.1 (LTS) for Data Center
- Crowd: 6.2.2 for Data Center
- Jira: 9.12.15 (LTS)
Atlassian strongly recommends users upgrade to the latest versions of their products to address these vulnerabilities.
