Atlassian has published its August 2024 security bulletin, which details nine high-severity vulnerabilities impacting Bamboo, Confluence, Crowd, and Jira products.
Bamboo Data Center and Server received patches for two high-severity flaws, including an authenticated remote code execution bug tracked as CVE-2024-21689.
The second issue, a denial-of-service (DoS) security defect, impacts the Bouncy Castle Java dependency used by the product. Tracked as CVE-2024-29857, it can be exploited without authentication.
Patches released for Confluence Data Center and Server resolve two high-severity security defects, including a DoS issue in Apache Tomcat (CVE-2024-34750) that can be exploited by unauthenticated attackers.
The second flaw is a reflected cross-site scripting (XSS) and cross-site request forgery (CSRF) issue tracked as CVE-2024-21690, which could allow a remote, unauthenticated attacker to execute arbitrary HTML or JavaScript code in a victim’s browser.
The attacker could “force an end user to execute unwanted actions on a web application in which they’re currently authenticated”, the company explains.
Atlassian resolved three high-severity SSRF bugs in Crowd Data Center and Server. Tracked as CVE-2024-22259, CVE-2024-22243, and CVE-2024-22262, all three affect the Spring Framework used by the product.
The company also announced patches for a high-severity flaw in the Apache Tomcat dependency of Jira Data Center and Server and Jira Service Management Data Center and Server. Tracked as CVE-2024-34750, the issue can be exploited to cause a DoS condition.
Advertisement. Scroll to continue reading.
Patches for these vulnerabilities, Atlassian says in its security bulletin, were released over the past month. Users are advised to update their installations as soon as possible, although the company makes no mention of any of these flaws being exploited in the wild.