TeliApp Corporation — IT and cybersecurity for New Jersey government
←Back to Intelligence Feed
VulnerabilitySecurity

Actively Exploited Vulnerability in Atlassian Data Center Products Could Allow for Arbitrary File Access

A vulnerability in Atlassian Data Center products could allow for arbitrary file access. Atlassian Data Center products are self-managed, enterprise-grade editions of Atlassian tools such as Jira, Confluence, Bitbucket, and Jira Service Management, which organizations host on their own infrastructure or private cloud and which offer clustering, high availability, and greater control over data, security, and scaling. Successful exploitation of this vulnerability could allow for arbitrary file access.

There are reports of this vulnerability being exploited in the wild.

SYSTEMS AFFECTED:

  • Bitbucket Data Center prior to 9.4.26, 10.2.8 and 10.5.1
  • Confluence Data Center prior to 9.2.26 and 10.2.19
  • Jira Software Data Center and Jira Service Management Data Center prior to 10.3.26 and 11.3.12 (also 9.12.40 for Jira Software and 5.12.40 for Jira Service Management)
  • Bamboo Data Center prior to 10.2.24 and 12.1.12
  • Crowd Data Center prior to 6.3.7, 7.0.3, 7.1.7 and 7.2.4
  • Crucible and Fisheye prior to 4.9.15

RISK:

  • Government: Large and medium government entities: High; Small government entities: N/A
  • Businesses: Large and medium business entities: High; Small business entities: N/A
  • Home users: N/A

We recommend the following actions be taken:

  • Apply appropriate updates to vulnerable systems immediately after appropriate testing.
  • Use vulnerability scanning to find potentially exploitable software vulnerabilities to remediate them.
  • Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.

Please do not hesitate to contact us here at Cyber Command with any questions.

REFERENCES:

Atlassian:

Helpnetsecurity: