David Black

Name of the Vulnerable Software and Affected Versions: Jira Server and Data Center versions 8.5.13 and earlier, versions 8.6.0 through 8.13.4, and versions 8.14.0 through 8.15.0 Jira Server versions 8.5.13 and earlier, versions 8.6.0 through 8.13.4, and versions 8.14.0 through 8.15.0 Jira Data Center versions 8.5.13 and earlier, versions 8.6.0 through 8.13.4, and versions 8.14.0 through 8.15.0 Description: The membersOf JQL search function allows remote anonymous attackers to determine if a group exists and members of groups if they are assigned to publicly visible issue fields. Recommendations: For versions 8.5.13 and earlier, update to version 8.5.13 or later. For versions 8.6.0 through 8.13.4, update to version 8.13.5 or later. For versions 8.14.0 through 8.15.0, update to version 8.15.1 or later.

The issue allows remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes and jira-installation/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials.

A DOM based cross-site scripting flaw was found in the administration console of the JBoss Application Server. A remote attacker could provide a specially-crafted web page and trick a valid JBoss AS user with administrator privilege to visit it, leading to DOM environment modification and arbitrary HTML or web script execution.

A CSRF issue was found in JBoss Application Server, where it did not properly restrict access to the management console information. This can be exploited via the `Access-Control-Allow-Origin` HTTP access control flag, potentially leading to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات Atlassian Jira من 7.6.4 إلى 8.1.0 الوصف: توجد ثغرة أمنية من نوع CSRF نظرًا لأن نموذج تسجيل الدخول لا يتطلب رمز CSRF. وهذا يسمح للمهاجم بتسجيل دخول مستخدم إلى النظام باستخدام حساب غير متوقع. التوصيات: بالنسبة لإصدارات Atlassian Jira من 7.6.4 إلى 8.1.0، قم بالتحديث إلى إصدار يتضمن تصحيحًا لهذه المشكلة لمنع هجمات CSRF. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

Name of the Vulnerable Software and Affected Versions: Application Links versions prior to 5.0.11 Application Links versions 5.1.0 through 5.2.10 Application Links versions 5.3.0 through 5.3.6 Application Links versions 5.4.0 through 5.4.12 Application Links versions 6.0.0 through 6.0.4 Confluence versions prior to 6.15.2 Crucible versions prior to 4.7.0 Crowd versions prior to 3.4.3 Fisheye versions prior to 4.7.0 Jira versions prior to 7.13.3 Jira versions 8.x prior to 8.1.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the `applinkStartingUrl` parameter. This affects various Atlassian products. Recommendations: For Application Links versions prior to 5.0.11, update to version 5.0.11 or later. For Application Links versions 5.1.0 through 5.2.10, update to version 5.2.10 or later. For Application Links versions 5.3.0 through 5.3.6, update to version 5.3.6 or later. For Application Links versions 5.4.0 through 5.4.12, update to version 5.4.12 or later. For Application Links versions 6.0.0 through 6.0.4, update to version 6.0.4 or later. For Confluence versions prior to 6.15.2, update to version 6.15.2 or later. For Crucible versions prior to 4.7.0, update to version 4.7.0 or later. For Crowd versions prior to 3.4.3, update to version 3.4.3 or later. For Fisheye versions prior to 4.7.0, update to version 4.7.0 or later. For Jira versions prior to 7.13.3, update to version 7.13.3 or later. For Jira versions 8.x prior to 8.1.0, update to version 8.1.0 or later.

A path traversal vulnerability exists in the downloadallattachments resource of Confluence Server and Data Center. This vulnerability can be exploited by a remote attacker who has permission to add attachments to pages and/or blogs, create a new space or personal space, or has 'Admin' permissions for a space. The attacker can write files to arbitrary locations, potentially leading to remote code execution on systems running a vulnerable version of Confluence Server or Data Center.

Name of the Vulnerable Software and Affected Versions: atlassian-http library versions prior to 2.0.2 Description: The issue allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a content-type of `application/mathml+xml`. This affects various Atlassian products. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.

The issue is related to a flaw in NPAPI plugins, such as Adobe Flash, which can bypass CORS restrictions by making a same-origin POST request that redirects to the target site, allowing for cross-site request forgery (CSRF) attacks. This can enable a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Name of the Vulnerable Software and Affected Versions: Fisheye versions prior to 4.4.5 Fisheye versions 4.5.0 through 4.5.1 Crucible versions prior to 4.4.5 Crucible versions 4.5.0 through 4.5.1 Description: The issue allows for double OGNL evaluation in certain redirect actions and in WebWork URL and Anchor tags in JSP files. An attacker with access to the web interface of Fisheye or Crucible, or who hosts a website visited by a user with such access, can exploit this to execute Java code of their choice on systems running a vulnerable version. Recommendations: For Fisheye versions prior to 4.4.5, update to version 4.4.5 or later. For Fisheye versions 4.5.0 through 4.5.1, update to version 4.5.2 or later. For Crucible versions prior to 4.4.5, update to version 4.4.5 or later. For Crucible versions 4.5.0 through 4.5.1, update to version 4.5.2 or later.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `jig` parameter in the `get last conversation lines` function located in `common/logger.py`.

The issue allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute, specifically through the exec command function in common/helpers.py.

The issue allows remote authenticated users to overwrite arbitrary files via a crafted tarball or manifest when the EC2 API and the S3/RegisterImage image-registration method are enabled.