CVE Vulnerability Advisory Database

[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.

[Impact] Unauthenticated remote attackers can access sensitive files within the web application root directory, leading to information disclosure.

[Mitigation] Immediately upgrade to the fixed versions provided by Atlassian and restrict access to sensitive web root files.

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.

[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)

[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.

[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.

[Affected Scope] On-premise deployments of Atlassian Confluence Data Center and Confluence Server (Atlassian Cloud instances are not affected)

[Impact] Unauthenticated remote attackers can bypass access controls to access setup endpoints, create unauthorized administrator accounts, and achieve full system compromise

[Mitigation] Immediately upgrade to the patched official versions, or restrict external access to the vulnerable /setup/* endpoints if patching cannot be applied immediately

[Affected Scope] Atlassian Bitbucket Server and Data Center versions 7.0.0 up to 8.3.0 (excluding specific patched releases)

[Impact] Remote attackers with read permissions to a public or private repository can execute arbitrary OS commands via malicious HTTP requests

[Mitigation] Immediately upgrade Bitbucket instances to the official patched versions (7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1 or higher)

[Affected Scope] Confluence Server and Data Center environments with Questions for Confluence app versions 2.7.34, 2.7.35, and 3.0.2 installed

[Impact] A remote, unauthenticated attacker can exploit the hardcoded 'disabledsystemuser' account to log into Confluence and access all sensitive content

[Mitigation] Immediately upgrade the Questions for Confluence app to a non-vulnerable version or disable/delete the 'disabledsystemuser' account

[Affected Scope] Atlassian Confluence Server and Data Center versions from 1.3.0 before 7.4.17, and specific release lines up to 7.18.1

[Impact] An unauthenticated remote attacker can execute arbitrary Java code on the Confluence instance with system privileges, leading to full host compromise.

[Mitigation] Immediately upgrade Confluence to the patched versions (7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1 or higher) or apply the vendor-provided workaround JAR files.

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 6.13.23, 6.14.0 to < 7.4.11, 7.5.0 to < 7.11.6, and 7.12.0 to < 7.12.5

[Impact] An unauthenticated, remote attacker can execute arbitrary OS commands with system privileges on the target instance by sending a specially crafted HTTP request.

[Mitigation] Immediately upgrade Confluence instances to the patched versions (6.13.23, 7.4.11, 7.11.6, 7.12.5, or later) or apply the vendor-provided workaround scripts.

[Affected Scope] Atlassian Jira Server and Data Center versions before 8.5.14, 8.6.0 before 8.13.6, and 8.14.0 before 8.16.1

[Impact] Unauthenticated remote attackers can exploit a path traversal vulnerability to read sensitive configuration files, such as '/WEB-INF/web.xml'

[Mitigation] Immediately upgrade Jira instances to the patched versions (8.5.14, 8.13.6, 8.16.1, or later) and apply WAF access control rules

[Affected Scope] Atlassian Confluence Server and Data Center versions prior to 7.4.10, and versions from 7.5.0 prior to 7.12.3

[Impact] Unauthenticated remote attackers can bypass authorization checks via the '/s/' endpoint to view restricted resources and sensitive internal files

[Mitigation] Immediately upgrade affected instances to official patched versions (7.4.10, 7.12.3, or later), or restrict suspicious requests to the '/s/' endpoint using a WAF or reverse proxy

[Affected Scope] Jira Server and Data Center versions from 4.4.0 before 7.6.14, 7.7.0 before 7.13.5, 8.0.0 before 8.0.3, 8.1.0 before 8.1.2, and 8.2.0 before 8.2.3

[Impact] Unauthenticated remote attackers can exploit the email template rendering logic to execute arbitrary system commands, leading to full system compromise

[Mitigation] Immediately upgrade Jira Server and Data Center to the patched versions (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 or later)

[Affected Scope] Atlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)

[Impact] Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system

[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin

[Affected Scope] Atlassian Confluence Server and Data Center versions from 2.0.0 before 6.15.2

[Impact] Remote authenticated attackers with attachment or space creation permissions can write arbitrary files to the system, leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade Confluence Server and Data Center to the patched versions (6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2 or later)

[Affected Scope] Atlassian Confluence Server and Data Center before 6.6.12, 6.7.0 to before 6.12.3, 6.13.0 to before 6.13.3, and 6.14.0 to before 6.14.2

[Impact] Unauthenticated remote attackers can achieve path traversal and execute arbitrary code (RCE) on the host server via Server-Side Template Injection (SSTI)

[Mitigation] Immediately upgrade Confluence to the patched versions (6.6.12, 6.12.3, 6.13.3, 6.14.2 or later) or disable the Widget Connector macro