PT-2022-3872 · Atlassian · Bitbucket+6

Published 2022-02-25 · Updated 2024-10-03 · CVE-2022-26137

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Bamboo versions prior to 8.0.9 Atlassian Bamboo versions 8.1.0 through 8.1.8 Atlassian Bamboo versions 8.2.0 through 8.2.4 Atlassian Bitbucket versions prior to 7.6.16 Atlassian Bitbucket versions 7.7.0 through 7.17.8 Atlassian Bitbucket versions 7.18.0 through 7.19.5 Atlassian Bitbucket versions 7.20.0 through 7.20.2 Atlassian Bitbucket versions 7.21.0 through 7.21.2 Atlassian Bitbucket versions 8.0.0 and 8.1.0 Atlassian Confluence versions prior to 7.4.17 Atlassian Confluence versions 7.5.0 through 7.13.7 Atlassian Confluence versions 7.14.0 through 7.14.3 Atlassian Confluence versions 7.15.0 through 7.15.2 Atlassian Confluence versions 7.16.0 through 7.16.4 Atlassian Confluence versions 7.17.0 through 7.17.4 Atlassian Confluence version 7.21.0 Atlassian Crowd versions prior to 4.3.8 Atlassian Crowd versions 4.4.0 through 4.4.2 Atlassian Crowd version 5.0.0 Atlassian Fisheye and Crucible versions prior to 4.8.10 Atlassian Jira versions prior to 8.13.22 Atlassian Jira versions 8.14.0 through 8.20.10 Atlassian Jira versions 8.21.0 through 8.22.4 Atlassian Jira Service Management versions prior to 4.13.22 Atlassian Jira Service Management versions 4.14.0 through 4.20.10 Atlassian Jira Service Management versions 4.21.0 through 4.22.4

Description A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions.

Recommendations Update Atlassian Bamboo to version 8.0.9 or later. Update Atlassian Bamboo to version 8.1.8 or later for versions 8.1.0 through 8.1.8. Update Atlassian Bamboo to version 8.2.4 or later for versions 8.2.0 through 8.2.4. Update Atlassian Bitbucket to version 7.6.16 or later. Update Atlassian Bitbucket to version 7.17.8 or later for versions 7.7.0 through 7.17.8. Update Atlassian Bitbucket to version 7.19.5 or later for versions 7.18.0 through 7.19.5. Update Atlassian Bitbucket to version 7.20.2 or later for versions 7.20.0 through 7.20.2. Update Atlassian Bitbucket to version 7.21.2 or later for versions 7.21.0 through 7.21.2. Update Atlassian Bitbucket to version 8.1.1 or later for versions 8.0.0 and 8.1.0. Update Atlassian Confluence to version 7.4.17 or later. Update Atlassian Confluence to version 7.13.7 or later for versions 7.5.0 through 7.13.7. Update Atlassian Confluence to version 7.14.3 or later for versions 7.14.0 through 7.14.3. Update Atlassian Confluence to version 7.15.2 or later for versions 7.15.0 through 7.15.2. Update Atlassian Confluence to version 7.16.4 or later for versions 7.16.0 through 7.16.4. Update Atlassian Confluence to version 7.17.4 or later for versions 7.17.0 through 7.17.4. Update Atlassian Confluence to version 7.21.1 or later for version 7.21.0. Update Atlassian Crowd to version 4.3.8 or later. Update Atlassian Crowd to version 4.4.2 or later for versions 4.4.0 through 4.4.2. Update Atlassian Crowd to version 5.0.1 or later for version 5.0.0. Update Atlassian Fisheye and Crucible to version 4.8.10 or later. Update Atlassian Jira to version 8.13.22 or later. Update Atlassian Jira to version 8.20.10 or later for versions 8.14.0 through 8.20.10. Update Atlassian Jira to version 8.22.4 or later for versions 8.21.0 through 8.22.4. Update Atlassian Jira Service Management to version 4.13.22 or later. Update Atlassian Jira Service Management to version 4.20.10 or later for versions 4.14.0 through 4.20.10. Update Atlassian Jira Service Management to version 4.22.4 or later for versions 4.21.0 through 4.22.4.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

CWE-180

Related Identifiers

BDU:2022-04675

CVE-2022-26137

Affected Products

Bamboo

Bitbucket

Confluence

Crowd

Fisheye/Crucible

Jira

Jira Service Management Server

References · 19

• https://jira.atlassian.com/browse/FE-7410 · Vendor Advisory
• https://jira.atlassian.com/browse/CRUC-8541 · Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-79476 · Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-73897 · Vendor Advisory
• https://jira.atlassian.com/browse/BSERV-13370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26137 · Security Note
• https://jira.atlassian.com/browse/JSDSERVER-11863 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26137 · Vendor Advisory
• https://jira.atlassian.com/browse/BAM-21795 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04675 · Security Note
• https://jira.atlassian.com/browse/CWD-5815 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26137 · Security Note
• https://vuldb.com/?id.204637 · Note
• https://t.me/cvenotify/33468 · Telegram Post
• https://t.me/sysadm_in_channel/4087 · Telegram Post