certfr_avis - certfr-2025-avi-0435

CERTFR-2025-AVI-0435

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Atlassian	Confluence	Confluence Data Center versions antérieures à 9.3.2
Atlassian	Jira	Jira Core Data Center versions antérieures à 9.12.22
Atlassian	Confluence	Confluence Data Center versions antérieures à 8.5.22
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 10.6.0
Atlassian	Jira	Jira Service Management Server versions antérieures à 10.6.0
Atlassian	Confluence	Confluence Server versions antérieures à 9.2.4
Atlassian	Jira	Jira Service Management Server versions antérieures à 5.12.22
Atlassian	Confluence	Confluence Server versions antérieures à 9.3.2
Atlassian	Jira	Jira Core Server versions antérieures à 10.5.1
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 10.3.5
Atlassian	Jira	Jira Core Server versions antérieures à 10.3.5
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 10.5.1
Atlassian	Confluence	Confluence Data Center versions antérieures à 9.2.4
Atlassian	Confluence	Confluence Server versions antérieures à 9.4.1
Atlassian	Jira	Jira Service Management Server versions antérieures à 9.12.22
Atlassian	Jira	Jira Service Management Server versions antérieures à 10.3.5
Atlassian	Jira	Jira Service Management Server versions antérieures à 10.5.1
Atlassian	Jira	Jira Core Data Center versions antérieures à 10.5.1
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 5.12.22
Atlassian	Confluence	Confluence Server versions antérieures à 8.5.22
Atlassian	Confluence	Confluence Data Center versions antérieures à 9.4.1
Atlassian	Jira	Jira Core Server versions antérieures à 10.6.0
Atlassian	Jira	Jira Core Data Center versions antérieures à 10.6.0
Atlassian	Jira	Jira Core Data Center versions antérieures à 10.3.5
Atlassian	Jira	Jira Core Server versions antérieures à 9.12.22
Atlassian	Jira	Jira Service Management Data Center versions antérieures à 9.12.22

References

Title

Publication Time

Tags

Bulletin de sécurité Atlassian CONFSERVER-99686	2025-05-20	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16206	2025-05-20	vendor-advisory
Bulletin de sécurité Atlassian JSDSERVER-16207	2025-05-20	vendor-advisory
Bulletin de sécurité Atlassian CONFSERVER-99568	2025-05-20	vendor-advisory
Bulletin de sécurité Atlassian JRASERVER-78766	2025-05-20	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.3.2",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Data Center versions ant\u00e9rieures \u00e0 9.12.22",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 8.5.22",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.6.0",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.6.0",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Server versions ant\u00e9rieures \u00e0 9.2.4",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 5.12.22",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Server versions ant\u00e9rieures \u00e0 9.3.2",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Server versions ant\u00e9rieures \u00e0 10.5.1",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Server versions ant\u00e9rieures \u00e0 10.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.5.1",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.4",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Server versions ant\u00e9rieures \u00e0 9.4.1",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 9.12.22",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.5.1",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Data Center versions ant\u00e9rieures \u00e0 10.5.1",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 5.12.22",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Server versions ant\u00e9rieures \u00e0 8.5.22",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.4.1",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Server versions ant\u00e9rieures \u00e0 10.6.0",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Data Center versions ant\u00e9rieures \u00e0 10.6.0",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Data Center versions ant\u00e9rieures \u00e0 10.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Core Server versions ant\u00e9rieures \u00e0 9.12.22",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 9.12.22",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-24970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
    },
    {
      "name": "CVE-2025-22157",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22157"
    },
    {
      "name": "CVE-2024-47072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47072"
    },
    {
      "name": "CVE-2025-31650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31650"
    }
  ],
  "initial_release_date": "2025-05-21T00:00:00",
  "last_revision_date": "2025-05-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0435",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
  "vendor_advisories": [
    {
      "published_at": "2025-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-99686",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-99686"
    },
    {
      "published_at": "2025-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16206",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16206"
    },
    {
      "published_at": "2025-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16207",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16207"
    },
    {
      "published_at": "2025-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-99568",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-99568"
    },
    {
      "published_at": "2025-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JRASERVER-78766",
      "url": "https://jira.atlassian.com/browse/JRASERVER-78766"
    }
  ]
}

CVE-2024-47072 (GCVE-0-2024-47072)

Vulnerability from cvelistv5

Published

2024-11-07 23:38

Modified

2024-11-08 15:20

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-121 - Stack-based Buffer Overflow
CWE-502 - Deserialization of Untrusted Data

Summary

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

References

URL

Tags

	https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q	x_refsource_CONFIRM
	https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266	x_refsource_MISC
	https://x-stream.github.io/CVE-2024-47072.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:x-stream:x-stream:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "x-stream",
            "vendor": "x-stream",
            "versions": [
              {
                "lessThan": "1.4.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T15:17:42.864003Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T15:20:08.949Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xstream",
          "vendor": "x-stream",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-07T23:38:52.978Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q"
        },
        {
          "name": "https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266"
        },
        {
          "name": "https://x-stream.github.io/CVE-2024-47072.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://x-stream.github.io/CVE-2024-47072.html"
        }
      ],
      "source": {
        "advisory": "GHSA-hfq9-hggm-c56q",
        "discovery": "UNKNOWN"
      },
      "title": "XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47072",
    "datePublished": "2024-11-07T23:38:52.978Z",
    "dateReserved": "2024-09-17T17:42:37.029Z",
    "dateUpdated": "2024-11-08T15:20:08.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-31650 (GCVE-0-2025-31650)

Vulnerability from cvelistv5

Published

2025-04-28 19:14

Modified

2025-08-08 11:43

Severity ?

CWE

CWE-459 - Incomplete Cleanup

Summary

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

References

URL

Tags

https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 9.0.76 ≤ 9.0.102 Version: 10.1.10 ≤ 10.1.39 Version: 11.0.0-M2 ≤ 11.0.5 Version: 8.5.90 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-28T22:02:46.448Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/04/28/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-31650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-06T20:07:38.530859Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T20:07:50.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "9.0.102",
              "status": "affected",
              "version": "9.0.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.39",
              "status": "affected",
              "version": "10.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "11.0.5",
              "status": "affected",
              "version": "11.0.0-M2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.90",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T11:43:00.251Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-31650",
    "datePublished": "2025-04-28T19:14:31.107Z",
    "dateReserved": "2025-03-31T12:13:57.705Z",
    "dateUpdated": "2025-08-08T11:43:00.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22157 (GCVE-0-2025-22157)

Vulnerability from cvelistv5

Published

2025-05-20 18:00

Modified

2025-05-21 03:55

Severity ?

7.2 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

PrivEsc (Privilege Escalation)

Summary

This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. Atlassian recommends that Jira Core Data Center and Server and Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Core Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.20 Jira Service Management Data Center and Server 5.12: Upgrade to a release greater than or equal to 5.12.20 Jira Core Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Service Management Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Core Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0 Jira Service Management Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0 Jira Core Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1 Jira Service Management Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1 See the release notes. You can download the latest version of Jira Core Data Center and Jira Service Management Data Center from the download center. This vulnerability was reported via our Atlassian (Internal) program.

References

URL

Tags

	https://confluence.atlassian.com/pages/viewpage.action?pageId=1561365992
	https://jira.atlassian.com/browse/JRASERVER-78766
	https://jira.atlassian.com/browse/JSDSERVER-16206

Impacted products

Vendor

Product

Version

Atlassian

Jira Core Data Center

Version: 10.5.0
Version: 10.4.0 to 10.4.1
Version: 10.3.0 to 10.3.4
Version: 9.12.0 to 9.12.19

Atlassian	Jira Core Server	Version: 9.12.0 to 9.12.19
Atlassian	Jira Service Management Data Center	Version: 10.5.0 Version: 10.4.0 to 10.4.1 Version: 10.3.0 to 10.3.4 Version: 5.12.0 to 5.12.19
Atlassian	Jira Service Management Server	Version: 5.12.0 to 5.12.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-20T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-21T03:55:32.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jira Core Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "10.5.0"
            },
            {
              "status": "affected",
              "version": "10.4.0 to 10.4.1"
            },
            {
              "status": "affected",
              "version": "10.3.0 to 10.3.4"
            },
            {
              "status": "affected",
              "version": "9.12.0 to 9.12.19"
            },
            {
              "status": "unaffected",
              "version": "10.6.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.1"
            },
            {
              "status": "unaffected",
              "version": "10.3.5 to 10.3.6"
            },
            {
              "status": "unaffected",
              "version": "9.12.22 to 9.12.23"
            }
          ]
        },
        {
          "product": "Jira Core Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "9.12.0 to 9.12.19"
            },
            {
              "status": "unaffected",
              "version": "9.12.22 to 9.12.23"
            }
          ]
        },
        {
          "product": "Jira Service Management Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "10.5.0"
            },
            {
              "status": "affected",
              "version": "10.4.0 to 10.4.1"
            },
            {
              "status": "affected",
              "version": "10.3.0 to 10.3.4"
            },
            {
              "status": "affected",
              "version": "5.12.0 to 5.12.19"
            },
            {
              "status": "unaffected",
              "version": "10.6.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.1"
            },
            {
              "status": "unaffected",
              "version": "10.3.5 to 10.3.6"
            },
            {
              "status": "unaffected",
              "version": "5.12.22 to 5.12.23"
            }
          ]
        },
        {
          "product": "Jira Service Management Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "5.12.0 to 5.12.19"
            },
            {
              "status": "unaffected",
              "version": "5.12.22 to 5.12.23"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:10.5.0:*:*:*:data_center:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "10.4.1",
                  "versionStartIncluding": "10.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "10.3.4",
                  "versionStartIncluding": "10.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "9.12.19",
                  "versionStartIncluding": "9.12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:10.6.0:*:*:*:data_center:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:10.5.1:*:*:*:data_center:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "10.3.6",
                  "versionStartIncluding": "10.3.5",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "9.12.23",
                  "versionStartIncluding": "9.12.22",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:server:*:*:*",
                  "versionEndIncluding": "9.12.19",
                  "versionStartIncluding": "9.12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_core:*:*:*:*:server:*:*:*",
                  "versionEndIncluding": "9.12.23",
                  "versionStartIncluding": "9.12.22",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:10.5.0:*:*:*:data_center:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "10.4.1",
                  "versionStartIncluding": "10.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "10.3.4",
                  "versionStartIncluding": "10.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "5.12.19",
                  "versionStartIncluding": "5.12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:10.6.0:*:*:*:data_center:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:10.5.1:*:*:*:data_center:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "10.3.6",
                  "versionStartIncluding": "10.3.5",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                  "versionEndIncluding": "5.12.23",
                  "versionStartIncluding": "5.12.22",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*",
                  "versionEndIncluding": "5.12.19",
                  "versionStartIncluding": "5.12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*",
                  "versionEndIncluding": "5.12.23",
                  "versionStartIncluding": "5.12.22",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Internal (Atlassian)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions:\n\n9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server\n\n5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server\n\nThis PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. \n\nAtlassian recommends that Jira Core Data Center and Server and Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\nJira Core Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.20\n\nJira Service Management Data Center and Server 5.12: Upgrade to a release greater than or equal to 5.12.20\n\nJira Core Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5\n\nJira Service Management Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5\n\nJira Core Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0\n\nJira Service Management Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0\n\nJira Core Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1\n\nJira Service Management Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1\n\nSee the release notes. You can download the latest version of Jira Core Data Center and Jira Service Management Data Center from the download center. \n\nThis vulnerability was reported via our Atlassian (Internal) program."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "PrivEsc (Privilege Escalation)",
              "lang": "en",
              "type": "PrivEsc (Privilege Escalation)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-20T18:00:01.328Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1561365992"
        },
        {
          "url": "https://jira.atlassian.com/browse/JRASERVER-78766"
        },
        {
          "url": "https://jira.atlassian.com/browse/JSDSERVER-16206"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2025-22157",
    "datePublished": "2025-05-20T18:00:01.328Z",
    "dateReserved": "2025-01-01T00:01:27.175Z",
    "dateUpdated": "2025-05-21T03:55:32.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-24970 (GCVE-0-2025-24970)

Vulnerability from cvelistv5

Published

2025-02-10 21:57

Modified

2025-04-16 15:37

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-20 - Improper Input Validation

Summary

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

References

URL

Tags

	https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw	x_refsource_CONFIRM
	https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	netty	netty	Version: >= 4.1.91.Final, <= 4.1.117.Final

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24970",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:30:54.865019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:31:38.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-16T15:37:17.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0005/"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.1.91.Final, \u003c= 4.1.117.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn\u0027t correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-10T21:57:28.730Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw"
        },
        {
          "name": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4"
        }
      ],
      "source": {
        "advisory": "GHSA-4g8c-wm8x-jfhw",
        "discovery": "UNKNOWN"
      },
      "title": "SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-24970",
    "datePublished": "2025-02-10T21:57:28.730Z",
    "dateReserved": "2025-01-29T15:18:03.210Z",
    "dateUpdated": "2025-04-16T15:37:17.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0435

Vulnerability from certfr_avis

Solutions

CVE-2024-47072 (GCVE-0-2024-47072)

Vulnerability from cvelistv5

CVE-2025-31650 (GCVE-0-2025-31650)

Vulnerability from cvelistv5

CVE-2025-22157 (GCVE-0-2025-22157)

Vulnerability from cvelistv5

CVE-2025-24970 (GCVE-0-2025-24970)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature