Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2017-9735
Vulnerability from cvelistv5
Published
2017-06-16 21:00
Modified
2024-08-05 17:18
Severity ?
EPSS score ?
Summary
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T17:18:01.294Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "99104", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/99104", }, { name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E", }, { name: "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E", }, { name: "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E", }, { name: "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E", }, { name: "[hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E", }, { name: "[hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://bugs.debian.org/864631", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/eclipse/jetty.project/issues/1556", }, { name: "[debian-lts-announce] 20210514 [SECURITY] [DLA 2661-1] jetty9 security update", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2017-06-16T00:00:00", descriptions: [ { lang: "en", value: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-07-20T22:53:10", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "99104", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/99104", }, { name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E", }, { name: "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E", }, { name: "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E", }, { name: "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E", }, { name: "[hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E", }, { name: "[hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_MISC", ], url: "https://bugs.debian.org/864631", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/eclipse/jetty.project/issues/1556", }, { name: "[debian-lts-announce] 20210514 [SECURITY] [DLA 2661-1] jetty9 security update", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2017-9735", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "99104", refsource: "BID", url: "http://www.securityfocus.com/bid/99104", }, { name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1", refsource: "MLIST", url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E", }, { name: "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", refsource: "MLIST", url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E", }, { name: "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", refsource: "MLIST", url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", }, { name: "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", refsource: "MLIST", url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", }, { name: "[hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", refsource: "MLIST", url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E", }, { name: "[hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", refsource: "MLIST", url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", refsource: "MISC", url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://bugs.debian.org/864631", refsource: "MISC", url: "https://bugs.debian.org/864631", }, { name: "https://github.com/eclipse/jetty.project/issues/1556", refsource: "MISC", url: "https://github.com/eclipse/jetty.project/issues/1556", }, { name: "[debian-lts-announce] 20210514 [SECURITY] [DLA 2661-1] jetty9 security update", refsource: "MLIST", url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { name: "https://www.oracle.com//security-alerts/cpujul2021.html", refsource: "MISC", url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2017-9735", datePublished: "2017-06-16T21:00:00", dateReserved: "2017-06-16T00:00:00", dateUpdated: "2024-08-05T17:18:01.294Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2017-9735\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-06-16T21:29:00.710\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.\"},{\"lang\":\"es\",\"value\":\"Jetty hasta la versión 9.4.x es propenso a una sincronización de canal en util/security/Password.java, lo que facilita que atacantes remotos obtengan acceso observando el tiempo transcurrido antes de rechazar contraseñas incorrectas. SR 760 Feeder Protection Relay, en versiones de firmware anteriores a la 7.47; SR 469 Motor Protection Relay, en versiones de firmware anteriores a la 5.23; SR 489 Generator Protection Relay, en versiones de firmware anteriores a la 4.06; SR 745 Transformer Protection Relay, en versiones de firmware anteriores a la 5.23; SR 369 Motor Protection Relay, en todas las versiones de firmware; Multilin Universal Relay, en versiones de firmware 6.0 y anteriores; y Multilin URplus (D90, C90, B95), en todas las versiones. Las versiones en texto cifrado de contraseñas de usuario fueron creadas con un vector de inicialización no aleatorio, dejándolas expuestas a ataques de diccionario. El texto cifrado de las contraseñas de usuario se pueden obtener del panel LCD de los productos afectados y a través de los comandos Modbus enviados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-203\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.2.22\",\"matchCriteriaId\":\"CDC78342-7D90-4360-8BF1-F59AA812A5CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3.0\",\"versionEndExcluding\":\"9.3.20\",\"matchCriteriaId\":\"87B0BE2C-7D3E-4109-943D-4C9820AA8A58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.4.0\",\"versionEndExcluding\":\"9.4.6\",\"matchCriteriaId\":\"C4E56EF2-6D17-41A3-8C7A-7A5D93BDD085\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AA0A02F-18B1-42E6-80F3-8C6D11A73118\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40F194FC-4116-45C4-A5B4-B9822EAC3250\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DBED5A1-5D0A-40D6-ACF1-695F7FCA70FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A3DC116-2844-47A1-BEC2-D0675DD97148\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F1DF3E-0F2D-4EFC-9A3E-F72149C8AE94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"36FC547E-861A-418C-A314-DA09A457B13A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"DF9FEE51-50E3-41E9-AA0D-272A640F85CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"E69E905F-2E1A-4462-9082-FF7B10474496\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"0F9B692C-8986-4F91-9EF4-2BB1E3B5C133\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0ED83E3-E6BF-4EAA-AF8F-33485A88A218\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11DA6839-849D-4CEF-85F3-38FE75E07183\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BCE78490-A4BE-40BD-8C72-0A4526BBD4A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55AE3629-4A66-49E4-A33D-6D81CC94962F\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/99104\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugs.debian.org/864631\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/eclipse/jetty.project/issues/1556\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/99104\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://bugs.debian.org/864631\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/eclipse/jetty.project/issues/1556\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}", }, }
WID-SEC-W-2023-2993
Vulnerability from csaf_certbund
Published
2023-11-21 23:00
Modified
2023-12-12 23:00
Summary
Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence and Atlassian Jira Software: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.
Bitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.
Confluence ist eine kommerzielle Wiki-Software.
Jira ist eine Webanwendung zur Softwareentwicklung.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Windows
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.\r\nBitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.\r\nConfluence ist eine kommerzielle Wiki-Software.\r\nJira ist eine Webanwendung zur Softwareentwicklung.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- Linux\n- MacOS X\n- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2023-2993 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2993.json", }, { category: "self", summary: "WID-SEC-2023-2993 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2993", }, { category: "external", summary: "Atlassian Security Bulletin vom 2023-11-21", url: "https://confluence.atlassian.com/security/security-bulletin-november-21-2023-1318881573.html", }, { category: "external", summary: "Atlassian Security Bulletin December 12 2023 vom 2023-12-12", url: "https://confluence.atlassian.com/security/security-bulletin-december-12-2023-1319249520.html", }, ], source_lang: "en-US", title: "Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence and Atlassian Jira Software: Mehrere Schwachstellen", tracking: { current_release_date: "2023-12-12T23:00:00.000+00:00", generator: { date: "2024-08-15T18:01:59.515+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2023-2993", initial_release_date: "2023-11-21T23:00:00.000+00:00", revision_history: [ { date: "2023-11-21T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2023-11-23T23:00:00.000+00:00", number: "2", summary: "Bewertung angepasst", }, { date: "2023-12-12T23:00:00.000+00:00", number: "3", summary: "Neue Updates aufgenommen", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Atlassian Bamboo < 9.2.7", product: { name: "Atlassian Bamboo < 9.2.7", product_id: "1529586", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.2.7", }, }, }, { category: "product_name", name: "Atlassian Bamboo < 9.2.7", product: { name: "Atlassian Bamboo < 9.2.7", product_id: "T031322", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.2.7", }, }, }, { category: "product_name", name: "Atlassian Bamboo < 9.3.4", product: { name: "Atlassian Bamboo < 9.3.4", product_id: "T031323", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.3.4", }, }, }, { category: "product_name", name: "Atlassian Bamboo < 9.3.5", product: { name: "Atlassian Bamboo < 9.3.5", product_id: "T031324", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.3.5", }, }, }, ], category: "product_name", name: "Bamboo", }, { branches: [ { category: "product_name", name: "Atlassian Bitbucket < 7.21.18", product: { name: "Atlassian Bitbucket < 7.21.18", product_id: "T031325", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:7.21.18", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.9.7", product: { name: "Atlassian Bitbucket < 8.9.7", product_id: "T031614", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.9.7", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.11.6", product: { name: "Atlassian Bitbucket < 8.11.6", product_id: "T031615", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.11.6", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.12.4", product: { name: "Atlassian Bitbucket < 8.12.4", product_id: "T031616", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.12.4", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.13.3", product: { name: "Atlassian Bitbucket < 8.13.3", product_id: "T031617", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.13.3", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.14.2", product: { name: "Atlassian Bitbucket < 8.14.2", product_id: "T031618", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.14.2", }, }, }, ], category: "product_name", name: "Bitbucket", }, { branches: [ { category: "product_name", name: "Atlassian Confluence < 8.3.4", product: { name: "Atlassian Confluence < 8.3.4", product_id: "T030846", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.3.4", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.6.1", product: { name: "Atlassian Confluence < 8.6.1", product_id: "T031326", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.6.1", }, }, }, { category: "product_name", name: "Atlassian Confluence < 7.19.17", product: { name: "Atlassian Confluence < 7.19.17", product_id: "T031609", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:7.19.17", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.4.5", product: { name: "Atlassian Confluence < 8.4.5", product_id: "T031610", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.4.5", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.5.4", product: { name: "Atlassian Confluence < 8.5.4", product_id: "T031611", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.5.4", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.6.2", product: { name: "Atlassian Confluence < 8.6.2", product_id: "T031612", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.6.2", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.7.1", product: { name: "Atlassian Confluence < 8.7.1", product_id: "T031613", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.7.1", }, }, }, ], category: "product_name", name: "Confluence", }, { branches: [ { category: "product_name", name: "Atlassian Jira Software < 9.11.3", product: { name: "Atlassian Jira Software < 9.11.3", product_id: "T031327", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:9.11.3", }, }, }, { category: "product_name", name: "Atlassian Jira Software < 9.4.13", product: { name: "Atlassian Jira Software < 9.4.13", product_id: "T031606", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:9.4.13", }, }, }, { category: "product_name", name: "Atlassian Jira Software Service Management < 4.20.28", product: { name: "Atlassian Jira Software Service Management < 4.20.28", product_id: "T031607", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:service_management__4.20.28", }, }, }, { category: "product_name", name: "Atlassian Jira Software Service Management < 5.4.12", product: { name: "Atlassian Jira Software Service Management < 5.4.12", product_id: "T031608", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:service_management__5.4.12", }, }, }, ], category: "product_name", name: "Jira Software", }, ], category: "vendor", name: "Atlassian", }, ], }, vulnerabilities: [ { cve: "CVE-2023-44487", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-44487", }, { cve: "CVE-2023-42794", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-42794", }, { cve: "CVE-2023-34396", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-34396", }, { cve: "CVE-2023-2976", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-2976", }, { cve: "CVE-2023-22521", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-22521", }, { cve: "CVE-2023-22516", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-22516", }, { cve: "CVE-2022-45143", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-45143", }, { cve: "CVE-2022-42890", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42890", }, { cve: "CVE-2022-42252", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42252", }, { cve: "CVE-2022-42004", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42004", }, { cve: "CVE-2022-42003", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42003", }, { cve: "CVE-2022-41704", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-41704", }, { cve: "CVE-2022-40146", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-40146", }, { cve: "CVE-2022-28366", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-28366", }, { cve: "CVE-2022-25647", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-25647", }, { cve: "CVE-2021-46877", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-46877", }, { cve: "CVE-2021-40690", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-40690", }, { cve: "CVE-2021-37714", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-37714", }, { cve: "CVE-2021-28165", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-28165", }, { cve: "CVE-2020-36518", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2020-36518", }, { cve: "CVE-2017-9735", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2017-9735", }, { cve: "CVE-2017-7656", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2017-7656", }, ], }
wid-sec-w-2023-2993
Vulnerability from csaf_certbund
Published
2023-11-21 23:00
Modified
2023-12-12 23:00
Summary
Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence and Atlassian Jira Software: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.
Bitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.
Confluence ist eine kommerzielle Wiki-Software.
Jira ist eine Webanwendung zur Softwareentwicklung.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Windows
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.\r\nBitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.\r\nConfluence ist eine kommerzielle Wiki-Software.\r\nJira ist eine Webanwendung zur Softwareentwicklung.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- Linux\n- MacOS X\n- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2023-2993 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2993.json", }, { category: "self", summary: "WID-SEC-2023-2993 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2993", }, { category: "external", summary: "Atlassian Security Bulletin vom 2023-11-21", url: "https://confluence.atlassian.com/security/security-bulletin-november-21-2023-1318881573.html", }, { category: "external", summary: "Atlassian Security Bulletin December 12 2023 vom 2023-12-12", url: "https://confluence.atlassian.com/security/security-bulletin-december-12-2023-1319249520.html", }, ], source_lang: "en-US", title: "Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence and Atlassian Jira Software: Mehrere Schwachstellen", tracking: { current_release_date: "2023-12-12T23:00:00.000+00:00", generator: { date: "2024-08-15T18:01:59.515+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2023-2993", initial_release_date: "2023-11-21T23:00:00.000+00:00", revision_history: [ { date: "2023-11-21T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2023-11-23T23:00:00.000+00:00", number: "2", summary: "Bewertung angepasst", }, { date: "2023-12-12T23:00:00.000+00:00", number: "3", summary: "Neue Updates aufgenommen", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Atlassian Bamboo < 9.2.7", product: { name: "Atlassian Bamboo < 9.2.7", product_id: "1529586", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.2.7", }, }, }, { category: "product_name", name: "Atlassian Bamboo < 9.2.7", product: { name: "Atlassian Bamboo < 9.2.7", product_id: "T031322", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.2.7", }, }, }, { category: "product_name", name: "Atlassian Bamboo < 9.3.4", product: { name: "Atlassian Bamboo < 9.3.4", product_id: "T031323", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.3.4", }, }, }, { category: "product_name", name: "Atlassian Bamboo < 9.3.5", product: { name: "Atlassian Bamboo < 9.3.5", product_id: "T031324", product_identification_helper: { cpe: "cpe:/a:atlassian:bamboo:9.3.5", }, }, }, ], category: "product_name", name: "Bamboo", }, { branches: [ { category: "product_name", name: "Atlassian Bitbucket < 7.21.18", product: { name: "Atlassian Bitbucket < 7.21.18", product_id: "T031325", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:7.21.18", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.9.7", product: { name: "Atlassian Bitbucket < 8.9.7", product_id: "T031614", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.9.7", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.11.6", product: { name: "Atlassian Bitbucket < 8.11.6", product_id: "T031615", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.11.6", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.12.4", product: { name: "Atlassian Bitbucket < 8.12.4", product_id: "T031616", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.12.4", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.13.3", product: { name: "Atlassian Bitbucket < 8.13.3", product_id: "T031617", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.13.3", }, }, }, { category: "product_name", name: "Atlassian Bitbucket < 8.14.2", product: { name: "Atlassian Bitbucket < 8.14.2", product_id: "T031618", product_identification_helper: { cpe: "cpe:/a:atlassian:bitbucket:8.14.2", }, }, }, ], category: "product_name", name: "Bitbucket", }, { branches: [ { category: "product_name", name: "Atlassian Confluence < 8.3.4", product: { name: "Atlassian Confluence < 8.3.4", product_id: "T030846", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.3.4", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.6.1", product: { name: "Atlassian Confluence < 8.6.1", product_id: "T031326", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.6.1", }, }, }, { category: "product_name", name: "Atlassian Confluence < 7.19.17", product: { name: "Atlassian Confluence < 7.19.17", product_id: "T031609", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:7.19.17", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.4.5", product: { name: "Atlassian Confluence < 8.4.5", product_id: "T031610", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.4.5", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.5.4", product: { name: "Atlassian Confluence < 8.5.4", product_id: "T031611", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.5.4", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.6.2", product: { name: "Atlassian Confluence < 8.6.2", product_id: "T031612", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.6.2", }, }, }, { category: "product_name", name: "Atlassian Confluence < 8.7.1", product: { name: "Atlassian Confluence < 8.7.1", product_id: "T031613", product_identification_helper: { cpe: "cpe:/a:atlassian:confluence:8.7.1", }, }, }, ], category: "product_name", name: "Confluence", }, { branches: [ { category: "product_name", name: "Atlassian Jira Software < 9.11.3", product: { name: "Atlassian Jira Software < 9.11.3", product_id: "T031327", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:9.11.3", }, }, }, { category: "product_name", name: "Atlassian Jira Software < 9.4.13", product: { name: "Atlassian Jira Software < 9.4.13", product_id: "T031606", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:9.4.13", }, }, }, { category: "product_name", name: "Atlassian Jira Software Service Management < 4.20.28", product: { name: "Atlassian Jira Software Service Management < 4.20.28", product_id: "T031607", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:service_management__4.20.28", }, }, }, { category: "product_name", name: "Atlassian Jira Software Service Management < 5.4.12", product: { name: "Atlassian Jira Software Service Management < 5.4.12", product_id: "T031608", product_identification_helper: { cpe: "cpe:/a:atlassian:jira_software:service_management__5.4.12", }, }, }, ], category: "product_name", name: "Jira Software", }, ], category: "vendor", name: "Atlassian", }, ], }, vulnerabilities: [ { cve: "CVE-2023-44487", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-44487", }, { cve: "CVE-2023-42794", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-42794", }, { cve: "CVE-2023-34396", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-34396", }, { cve: "CVE-2023-2976", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-2976", }, { cve: "CVE-2023-22521", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-22521", }, { cve: "CVE-2023-22516", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2023-22516", }, { cve: "CVE-2022-45143", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-45143", }, { cve: "CVE-2022-42890", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42890", }, { cve: "CVE-2022-42252", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42252", }, { cve: "CVE-2022-42004", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42004", }, { cve: "CVE-2022-42003", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-42003", }, { cve: "CVE-2022-41704", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-41704", }, { cve: "CVE-2022-40146", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-40146", }, { cve: "CVE-2022-28366", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-28366", }, { cve: "CVE-2022-25647", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2022-25647", }, { cve: "CVE-2021-46877", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-46877", }, { cve: "CVE-2021-40690", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-40690", }, { cve: "CVE-2021-37714", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-37714", }, { cve: "CVE-2021-28165", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2021-28165", }, { cve: "CVE-2020-36518", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2020-36518", }, { cve: "CVE-2017-9735", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2017-9735", }, { cve: "CVE-2017-7656", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira Software. Diese Fehler bestehen unter anderem in verschiedenen Komponenten wie com.google.guava:guava oder jackson-databind. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen. Für eine erfolgreiche Ausnutzung einiger dieser Schwachstellen ist eine Anmeldung oder eine Interaktion des Nutzers notwendig.", }, ], product_status: { known_affected: [ "T031610", "T031612", "T031611", "T031614", "T031613", "1529586", "T030846", "T031616", "T031615", "T031607", "T031618", "T031606", "T031617", "T031609", "T031608", ], }, release_date: "2023-11-21T23:00:00.000+00:00", title: "CVE-2017-7656", }, ], }
ghsa-wfcc-pff6-rgc5
Vulnerability from github
Published
2018-10-19 16:15
Modified
2023-08-15 20:33
Severity ?
Summary
Jetty vulnerable to exposure of sensitive information due to observable discrepancy
Details
Jetty through 9.4.x contains a timing channel attack in util/security/Password.java
, which allows attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
{ affected: [ { database_specific: { last_known_affected_version_range: "<= 9.4.5.v20170502", }, package: { ecosystem: "Maven", name: "org.eclipse.jetty:jetty-server", }, ranges: [ { events: [ { introduced: "9.4.0", }, { fixed: "9.4.6.v20170531", }, ], type: "ECOSYSTEM", }, ], }, { database_specific: { last_known_affected_version_range: "<= 9.3.19.v20170502", }, package: { ecosystem: "Maven", name: "org.eclipse.jetty:jetty-server", }, ranges: [ { events: [ { introduced: "9.3.0", }, { fixed: "9.3.20.v20170531", }, ], type: "ECOSYSTEM", }, ], }, { database_specific: { last_known_affected_version_range: "<= 9.2.21.v20170120", }, package: { ecosystem: "Maven", name: "org.eclipse.jetty:jetty-server", }, ranges: [ { events: [ { introduced: "0", }, { fixed: "9.2.22.v20170606", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2017-9735", ], database_specific: { cwe_ids: [ "CWE-200", "CWE-203", ], github_reviewed: true, github_reviewed_at: "2020-06-16T22:00:10Z", nvd_published_at: "2017-06-16T21:29:00Z", severity: "HIGH", }, details: "Jetty through 9.4.x contains a timing channel attack in `util/security/Password.java`, which allows attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", id: "GHSA-wfcc-pff6-rgc5", modified: "2023-08-15T20:33:37Z", published: "2018-10-19T16:15:46Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2017-9735", }, { type: "WEB", url: "https://github.com/eclipse/jetty.project/issues/1556", }, { type: "WEB", url: "https://github.com/eclipse/jetty.project/commit/042f325f1cd6e7891d72c7e668f5947b5457dc02", }, { type: "WEB", url: "https://bugs.debian.org/864631", }, { type: "PACKAGE", url: "https://github.com/eclipse/jetty.project", }, { type: "WEB", url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E", }, { type: "WEB", url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { type: "WEB", url: "https://web.archive.org/web/20170826163336/http://www.securityfocus.com/bid/99104", }, { type: "WEB", url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, { type: "WEB", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { type: "WEB", url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", type: "CVSS_V3", }, ], summary: "Jetty vulnerable to exposure of sensitive information due to observable discrepancy", }
fkie_cve-2017-9735
Vulnerability from fkie_nvd
Published
2017-06-16 21:29
Modified
2025-04-20 01:37
Severity ?
Summary
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
eclipse | jetty | * | |
eclipse | jetty | * | |
eclipse | jetty | * | |
debian | debian_linux | 9.0 | |
oracle | communications_cloud_native_core_policy | 1.5.0 | |
oracle | enterprise_manager_base_platform | 13.2 | |
oracle | enterprise_manager_base_platform | 13.3 | |
oracle | hospitality_guest_access | 4.2.0 | |
oracle | hospitality_guest_access | 4.2.1 | |
oracle | rest_data_services | 11.2.0.4 | |
oracle | rest_data_services | 12.1.0.2 | |
oracle | rest_data_services | 12.2.0.1 | |
oracle | rest_data_services | 18c | |
oracle | retail_xstore_point_of_service | 7.1 | |
oracle | retail_xstore_point_of_service | 15.0 | |
oracle | retail_xstore_point_of_service | 16.0 | |
oracle | retail_xstore_point_of_service | 17.0 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", matchCriteriaId: "CDC78342-7D90-4360-8BF1-F59AA812A5CC", versionEndExcluding: "9.2.22", vulnerable: true, }, { criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", matchCriteriaId: "87B0BE2C-7D3E-4109-943D-4C9820AA8A58", versionEndExcluding: "9.3.20", versionStartIncluding: "9.3.0", vulnerable: true, }, { criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", matchCriteriaId: "C4E56EF2-6D17-41A3-8C7A-7A5D93BDD085", versionEndExcluding: "9.4.6", versionStartIncluding: "9.4.0", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", matchCriteriaId: "DEECE5FC-CACF-4496-A3E7-164736409252", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:*:*:*:*:*:*:*", matchCriteriaId: "6AA0A02F-18B1-42E6-80F3-8C6D11A73118", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*", matchCriteriaId: "40F194FC-4116-45C4-A5B4-B9822EAC3250", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*", matchCriteriaId: "7DBED5A1-5D0A-40D6-ACF1-695F7FCA70FE", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*", matchCriteriaId: "1A3DC116-2844-47A1-BEC2-D0675DD97148", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*", matchCriteriaId: "E0F1DF3E-0F2D-4EFC-9A3E-F72149C8AE94", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*", matchCriteriaId: "36FC547E-861A-418C-A314-DA09A457B13A", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*", matchCriteriaId: "DF9FEE51-50E3-41E9-AA0D-272A640F85CC", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*", matchCriteriaId: "E69E905F-2E1A-4462-9082-FF7B10474496", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*", matchCriteriaId: "0F9B692C-8986-4F91-9EF4-2BB1E3B5C133", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*", matchCriteriaId: "A0ED83E3-E6BF-4EAA-AF8F-33485A88A218", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*", matchCriteriaId: "11DA6839-849D-4CEF-85F3-38FE75E07183", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*", matchCriteriaId: "BCE78490-A4BE-40BD-8C72-0A4526BBD4A4", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*", matchCriteriaId: "55AE3629-4A66-49E4-A33D-6D81CC94962F", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", }, { lang: "es", value: "Jetty hasta la versión 9.4.x es propenso a una sincronización de canal en util/security/Password.java, lo que facilita que atacantes remotos obtengan acceso observando el tiempo transcurrido antes de rechazar contraseñas incorrectas. SR 760 Feeder Protection Relay, en versiones de firmware anteriores a la 7.47; SR 469 Motor Protection Relay, en versiones de firmware anteriores a la 5.23; SR 489 Generator Protection Relay, en versiones de firmware anteriores a la 4.06; SR 745 Transformer Protection Relay, en versiones de firmware anteriores a la 5.23; SR 369 Motor Protection Relay, en todas las versiones de firmware; Multilin Universal Relay, en versiones de firmware 6.0 y anteriores; y Multilin URplus (D90, C90, B95), en todas las versiones. Las versiones en texto cifrado de contraseñas de usuario fueron creadas con un vector de inicialización no aleatorio, dejándolas expuestas a ataques de diccionario. El texto cifrado de las contraseñas de usuario se pueden obtener del panel LCD de los productos afectados y a través de los comandos Modbus enviados.", }, ], id: "CVE-2017-9735", lastModified: "2025-04-20T01:37:25.860", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-06-16T21:29:00.710", references: [ { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/99104", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "https://bugs.debian.org/864631", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Patch", "Third Party Advisory", ], url: "https://github.com/eclipse/jetty.project/issues/1556", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E", }, { source: "cve@mitre.org", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { source: "cve@mitre.org", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/99104", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "https://bugs.debian.org/864631", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Patch", "Third Party Advisory", ], url: "https://github.com/eclipse/jetty.project/issues/1556", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a%40%3Ccommon-issues.hadoop.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "CWE-203", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
gsd-2017-9735
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Aliases
Aliases
{ GSD: { alias: "CVE-2017-9735", description: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", id: "GSD-2017-9735", references: [ "https://advisories.mageia.org/CVE-2017-9735.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2017-9735", ], details: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", id: "GSD-2017-9735", modified: "2023-12-13T01:21:07.643682Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2017-9735", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "99104", refsource: "BID", url: "http://www.securityfocus.com/bid/99104", }, { name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1", refsource: "MLIST", url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E", }, { name: "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", refsource: "MLIST", url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E", }, { name: "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", refsource: "MLIST", url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", }, { name: "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", refsource: "MLIST", url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", }, { name: "[hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", refsource: "MLIST", url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E", }, { name: "[hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", refsource: "MLIST", url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", refsource: "MISC", url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://bugs.debian.org/864631", refsource: "MISC", url: "https://bugs.debian.org/864631", }, { name: "https://github.com/eclipse/jetty.project/issues/1556", refsource: "MISC", url: "https://github.com/eclipse/jetty.project/issues/1556", }, { name: "[debian-lts-announce] 20210514 [SECURITY] [DLA 2661-1] jetty9 security update", refsource: "MLIST", url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { name: "https://www.oracle.com//security-alerts/cpujul2021.html", refsource: "MISC", url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, ], }, }, "gitlab.com": { advisories: [ { affected_range: "[9.4.0,9.4.5.v20170502],[9.3.0,9.3.19.v20170502],[9.2.0,9.2.21.v20170120]", affected_versions: "All versions starting from 9.4.0 up to 9.4.5.v20170502, all versions starting from 9.3.0 up to 9.3.19.v20170502, all versions starting from 9.2.0 up to 9.2.21.v20170120", cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", cwe_ids: [ "CWE-1035", "CWE-200", "CWE-937", ], date: "2021-06-10", description: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", fixed_versions: [ "9.4.6.v20170531", "9.4.6.v20170531", "9.4.6.v20170531", "9.2.22.v20170606", ], identifier: "CVE-2017-9735", identifiers: [ "GHSA-wfcc-pff6-rgc5", "CVE-2017-9735", ], not_impacted: "All versions before 9.4.0, all versions after 9.4.5.v20170502, all versions before 9.3.0, all versions after 9.3.19.v20170502, all versions before 9.2.0, all versions after 9.2.21.v20170120", package_slug: "maven/org.eclipse.jetty/jetty-server", pubdate: "2018-10-19", solution: "Upgrade to versions 9.4.6.v20170531, 9.4.6.v20170531, 9.4.6.v20170531, 9.2.22.v20170606 or above.", title: "Exposure of Sensitive Information to an Unauthorized Actor", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2017-9735", "https://github.com/eclipse/jetty.project/issues/1556", "https://bugs.debian.org/864631", "https://github.com/advisories/GHSA-wfcc-pff6-rgc5", "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E", "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E", "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E", "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E", "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "http://www.securityfocus.com/bid/99104", ], uuid: "0a24c129-863e-4a3a-9c3d-dd2725a9d9db", }, { affected_range: "(,9.4.6.v20170531)", affected_versions: "All versions before 9.4.6.v20170531", cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", cwe_ids: [ "CWE-1035", "CWE-200", "CWE-937", ], date: "2019-04-16", description: "Jetty is prone to a timing channel in `util/security/Password.java`, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", fixed_versions: [ "9.4.6.v20170531", ], identifier: "CVE-2017-9735", identifiers: [ "CVE-2017-9735", ], not_impacted: "All versions starting from 9.4.6.v20170531", package_slug: "maven/org.eclipse.jetty/jetty-util", pubdate: "2017-06-16", solution: "Upgrade to version 9.4.6.v20170531 or above.", title: "Information Exposure", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2017-9735", "http://www.securityfocus.com/bid/99104", ], uuid: "a1b7fe4d-78d9-4c97-86da-66652706f0e9", }, ], }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "9.2.22", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "9.3.20", versionStartIncluding: "9.3.0", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "9.4.6", versionStartIncluding: "9.4.0", vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2017-9735", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-203", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/eclipse/jetty.project/issues/1556", refsource: "MISC", tags: [ "Issue Tracking", "Patch", "Third Party Advisory", ], url: "https://github.com/eclipse/jetty.project/issues/1556", }, { name: "https://bugs.debian.org/864631", refsource: "MISC", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "https://bugs.debian.org/864631", }, { name: "99104", refsource: "BID", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securityfocus.com/bid/99104", }, { name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E", }, { name: "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", refsource: "MISC", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", }, { name: "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", }, { name: "[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", }, { name: "[hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E", }, { name: "[hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", tags: [ "Third Party Advisory", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "[debian-lts-announce] 20210514 [SECURITY] [DLA 2661-1] jetty9 security update", refsource: "MLIST", tags: [ "Mailing List", "Third Party Advisory", ], url: "https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html", }, { name: "N/A", refsource: "N/A", tags: [ "Third Party Advisory", ], url: "https://www.oracle.com//security-alerts/cpujul2021.html", }, ], }, }, impact: { baseMetricV2: { cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 5, confidentialityImpact: "PARTIAL", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, baseMetricV3: { cvssV3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 3.6, }, }, lastModifiedDate: "2022-03-15T14:55Z", publishedDate: "2017-06-16T21:29Z", }, }, }
ncsc-2024-0231
Vulnerability from csaf_ncscnl
Published
2024-05-22 11:13
Modified
2024-05-22 11:13
Summary
Kwetsbaarheden verholpen in Atlassian producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Atlassian heeft kwetsbaarheden verholpen in diverse producten, zoals Jira, Confluence en Bitbucket.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Cross-Site Request Forgery (XSRF)
- Denial-of-Service (DoS)
- Omzeilen van authenticatie
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- SQL Injection
- Toegang tot systeemgegevens
Oplossingen
Atlassian heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie:
https://confluence.atlassian.com/security/security-bulletin-may-21-2024-1387867145.html
Kans
medium
Schade
high
CWE-284
Improper Access Control
CWE-20
Improper Input Validation
CWE-281
Improper Preservation of Permissions
CWE-400
Uncontrolled Resource Consumption
CWE-404
Improper Resource Shutdown or Release
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-459
Incomplete Cleanup
CWE-502
Deserialization of Untrusted Data
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-913
Improper Control of Dynamically-Managed Code Resources
CWE-96
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
{ document: { category: "csaf_security_advisory", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", }, }, lang: "nl", notes: [ { category: "legal_disclaimer", text: "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.", }, { category: "description", text: "Atlassian heeft kwetsbaarheden verholpen in diverse producten, zoals Jira, Confluence en Bitbucket.", title: "Feiten", }, { category: "description", text: "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:\n\n- Cross-Site Request Forgery (XSRF)\n- Denial-of-Service (DoS)\n- Omzeilen van authenticatie\n- (Remote) code execution (Administrator/Root rechten)\n- (Remote) code execution (Gebruikersrechten)\n- SQL Injection\n- Toegang tot systeemgegevens\n", title: "Interpretaties", }, { category: "description", text: "Atlassian heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie:\n\nhttps://confluence.atlassian.com/security/security-bulletin-may-21-2024-1387867145.html", title: "Oplossingen", }, { category: "general", text: "medium", title: "Kans", }, { category: "general", text: "high", title: "Schade", }, { category: "general", text: "Improper Access Control", title: "CWE-284", }, { category: "general", text: "Improper Input Validation", title: "CWE-20", }, { category: "general", text: "Improper Preservation of Permissions", title: "CWE-281", }, { category: "general", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, { category: "general", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, { category: "general", text: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", title: "CWE-444", }, { category: "general", text: "Incomplete Cleanup", title: "CWE-459", }, { category: "general", text: "Deserialization of Untrusted Data", title: "CWE-502", }, { category: "general", text: "URL Redirection to Untrusted Site ('Open Redirect')", title: "CWE-601", }, { category: "general", text: "Allocation of Resources Without Limits or Throttling", title: "CWE-770", }, { category: "general", text: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", title: "CWE-89", }, { category: "general", text: "Improper Control of Dynamically-Managed Code Resources", title: "CWE-913", }, { category: "general", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], publisher: { category: "coordinator", contact_details: "cert@ncsc.nl", name: "Nationaal Cyber Security Centrum", namespace: "https://www.ncsc.nl/", }, references: [ { category: "external", summary: "Reference - cveprojectv5; nvd", url: "https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145", }, ], title: "Kwetsbaarheden verholpen in Atlassian producten", tracking: { current_release_date: "2024-05-22T11:13:07.693855Z", id: "NCSC-2024-0231", initial_release_date: "2024-05-22T11:13:07.693855Z", revision_history: [ { date: "2024-05-22T11:13:07.693855Z", number: "0", summary: "Initiele versie", }, ], status: "final", version: "1.0.0", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "bamboo", product: { name: "bamboo", product_id: "CSAFPID-716889", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "bitbucket", product: { name: "bitbucket", product_id: "CSAFPID-344199", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "confluence", product: { name: "confluence", product_id: "CSAFPID-551338", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "crowd", product: { name: "crowd", product_id: "CSAFPID-344399", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "jira_service_management", product: { name: "jira_service_management", product_id: "CSAFPID-343852", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", }, }, }, { category: "product_name", name: "jira_service_management", product: { name: "jira_service_management", product_id: "CSAFPID-343851", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", }, }, }, { category: "product_name", name: "jira", product: { name: "jira", product_id: "CSAFPID-98204", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", }, }, }, ], category: "vendor", name: "atlassian", }, ], }, vulnerabilities: [ { cve: "CVE-2017-7656", cwe: { id: "CWE-444", name: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", }, notes: [ { category: "other", text: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", title: "CWE-444", }, ], references: [ { category: "self", summary: "CVE-2017-7656", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2017/CVE-2017-7656.json", }, ], title: "CVE-2017-7656", }, { cve: "CVE-2017-9735", references: [ { category: "self", summary: "CVE-2017-9735", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2017/CVE-2017-9735.json", }, ], title: "CVE-2017-9735", }, { cve: "CVE-2020-10672", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-10672", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10672.json", }, ], title: "CVE-2020-10672", }, { cve: "CVE-2020-10673", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-10673", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10673.json", }, ], title: "CVE-2020-10673", }, { cve: "CVE-2020-10968", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-10968", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10968.json", }, ], title: "CVE-2020-10968", }, { cve: "CVE-2020-10969", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-10969", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10969.json", }, ], title: "CVE-2020-10969", }, { cve: "CVE-2020-11111", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-11111", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11111.json", }, ], title: "CVE-2020-11111", }, { cve: "CVE-2020-11112", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-11112", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11112.json", }, ], title: "CVE-2020-11112", }, { cve: "CVE-2020-11113", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-11113", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11113.json", }, ], title: "CVE-2020-11113", }, { cve: "CVE-2020-24616", references: [ { category: "self", summary: "CVE-2020-24616", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-24616.json", }, ], title: "CVE-2020-24616", }, { cve: "CVE-2020-35728", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-35728", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-35728.json", }, ], title: "CVE-2020-35728", }, { cve: "CVE-2020-36179", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36179", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36179.json", }, ], title: "CVE-2020-36179", }, { cve: "CVE-2020-36180", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36180", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36180.json", }, ], title: "CVE-2020-36180", }, { cve: "CVE-2020-36181", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36181", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36181.json", }, ], title: "CVE-2020-36181", }, { cve: "CVE-2020-36182", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36182", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36182.json", }, ], title: "CVE-2020-36182", }, { cve: "CVE-2020-36184", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36184", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36184.json", }, ], title: "CVE-2020-36184", }, { cve: "CVE-2020-36188", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36188", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36188.json", }, ], title: "CVE-2020-36188", }, { cve: "CVE-2021-28165", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, notes: [ { category: "other", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, ], references: [ { category: "self", summary: "CVE-2021-28165", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-28165.json", }, ], title: "CVE-2021-28165", }, { cve: "CVE-2022-25647", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2022-25647", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-25647.json", }, ], title: "CVE-2022-25647", }, { cve: "CVE-2022-41966", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, { category: "other", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, ], references: [ { category: "self", summary: "CVE-2022-41966", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-41966.json", }, ], title: "CVE-2022-41966", }, { cve: "CVE-2022-42003", cwe: { id: "CWE-404", name: "Improper Resource Shutdown or Release", }, notes: [ { category: "other", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2022-42003", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-42003.json", }, ], title: "CVE-2022-42003", }, { cve: "CVE-2023-4759", references: [ { category: "self", summary: "CVE-2023-4759", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4759.json", }, ], title: "CVE-2023-4759", }, { cve: "CVE-2023-34396", references: [ { category: "self", summary: "CVE-2023-34396", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-34396.json", }, ], title: "CVE-2023-34396", }, { cve: "CVE-2023-41835", cwe: { id: "CWE-913", name: "Improper Control of Dynamically-Managed Code Resources", }, notes: [ { category: "other", text: "Improper Control of Dynamically-Managed Code Resources", title: "CWE-913", }, ], references: [ { category: "self", summary: "CVE-2023-41835", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-41835.json", }, ], title: "CVE-2023-41835", }, { cve: "CVE-2023-45859", cwe: { id: "CWE-281", name: "Improper Preservation of Permissions", }, notes: [ { category: "other", text: "Improper Preservation of Permissions", title: "CWE-281", }, ], references: [ { category: "self", summary: "CVE-2023-45859", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45859.json", }, ], title: "CVE-2023-45859", }, { cve: "CVE-2024-1597", cwe: { id: "CWE-89", name: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", title: "CWE-89", }, ], references: [ { category: "self", summary: "CVE-2024-1597", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-1597.json", }, ], title: "CVE-2024-1597", }, { cve: "CVE-2024-21634", cwe: { id: "CWE-770", name: "Allocation of Resources Without Limits or Throttling", }, notes: [ { category: "other", text: "Allocation of Resources Without Limits or Throttling", title: "CWE-770", }, ], references: [ { category: "self", summary: "CVE-2024-21634", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21634.json", }, ], title: "CVE-2024-21634", }, { cve: "CVE-2024-21683", references: [ { category: "self", summary: "CVE-2024-21683", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21683.json", }, ], title: "CVE-2024-21683", }, { cve: "CVE-2024-22257", cwe: { id: "CWE-284", name: "Improper Access Control", }, notes: [ { category: "other", text: "Improper Access Control", title: "CWE-284", }, ], references: [ { category: "self", summary: "CVE-2024-22257", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22257.json", }, ], title: "CVE-2024-22257", }, { cve: "CVE-2024-22262", cwe: { id: "CWE-601", name: "URL Redirection to Untrusted Site ('Open Redirect')", }, notes: [ { category: "other", text: "URL Redirection to Untrusted Site ('Open Redirect')", title: "CWE-601", }, ], references: [ { category: "self", summary: "CVE-2024-22262", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22262.json", }, ], title: "CVE-2024-22262", }, { cve: "CVE-2024-23672", cwe: { id: "CWE-459", name: "Incomplete Cleanup", }, notes: [ { category: "other", text: "Incomplete Cleanup", title: "CWE-459", }, ], references: [ { category: "self", summary: "CVE-2024-23672", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23672.json", }, ], title: "CVE-2024-23672", }, { cve: "CVE-2024-24549", cwe: { id: "CWE-20", name: "Improper Input Validation", }, notes: [ { category: "other", text: "Improper Input Validation", title: "CWE-20", }, ], references: [ { category: "self", summary: "CVE-2024-24549", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24549.json", }, ], title: "CVE-2024-24549", }, ], }
NCSC-2024-0231
Vulnerability from csaf_ncscnl
Published
2024-05-22 11:13
Modified
2024-05-22 11:13
Summary
Kwetsbaarheden verholpen in Atlassian producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Atlassian heeft kwetsbaarheden verholpen in diverse producten, zoals Jira, Confluence en Bitbucket.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Cross-Site Request Forgery (XSRF)
- Denial-of-Service (DoS)
- Omzeilen van authenticatie
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- SQL Injection
- Toegang tot systeemgegevens
Oplossingen
Atlassian heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie:
https://confluence.atlassian.com/security/security-bulletin-may-21-2024-1387867145.html
Kans
medium
Schade
high
CWE-284
Improper Access Control
CWE-20
Improper Input Validation
CWE-281
Improper Preservation of Permissions
CWE-400
Uncontrolled Resource Consumption
CWE-404
Improper Resource Shutdown or Release
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-459
Incomplete Cleanup
CWE-502
Deserialization of Untrusted Data
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-913
Improper Control of Dynamically-Managed Code Resources
CWE-96
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
{ document: { category: "csaf_security_advisory", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", }, }, lang: "nl", notes: [ { category: "legal_disclaimer", text: "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.", }, { category: "description", text: "Atlassian heeft kwetsbaarheden verholpen in diverse producten, zoals Jira, Confluence en Bitbucket.", title: "Feiten", }, { category: "description", text: "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:\n\n- Cross-Site Request Forgery (XSRF)\n- Denial-of-Service (DoS)\n- Omzeilen van authenticatie\n- (Remote) code execution (Administrator/Root rechten)\n- (Remote) code execution (Gebruikersrechten)\n- SQL Injection\n- Toegang tot systeemgegevens\n", title: "Interpretaties", }, { category: "description", text: "Atlassian heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie:\n\nhttps://confluence.atlassian.com/security/security-bulletin-may-21-2024-1387867145.html", title: "Oplossingen", }, { category: "general", text: "medium", title: "Kans", }, { category: "general", text: "high", title: "Schade", }, { category: "general", text: "Improper Access Control", title: "CWE-284", }, { category: "general", text: "Improper Input Validation", title: "CWE-20", }, { category: "general", text: "Improper Preservation of Permissions", title: "CWE-281", }, { category: "general", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, { category: "general", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, { category: "general", text: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", title: "CWE-444", }, { category: "general", text: "Incomplete Cleanup", title: "CWE-459", }, { category: "general", text: "Deserialization of Untrusted Data", title: "CWE-502", }, { category: "general", text: "URL Redirection to Untrusted Site ('Open Redirect')", title: "CWE-601", }, { category: "general", text: "Allocation of Resources Without Limits or Throttling", title: "CWE-770", }, { category: "general", text: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", title: "CWE-89", }, { category: "general", text: "Improper Control of Dynamically-Managed Code Resources", title: "CWE-913", }, { category: "general", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], publisher: { category: "coordinator", contact_details: "cert@ncsc.nl", name: "Nationaal Cyber Security Centrum", namespace: "https://www.ncsc.nl/", }, references: [ { category: "external", summary: "Reference - cveprojectv5; nvd", url: "https://confluence.atlassian.com/pages/viewpage.action?pageId=1387867145", }, ], title: "Kwetsbaarheden verholpen in Atlassian producten", tracking: { current_release_date: "2024-05-22T11:13:07.693855Z", id: "NCSC-2024-0231", initial_release_date: "2024-05-22T11:13:07.693855Z", revision_history: [ { date: "2024-05-22T11:13:07.693855Z", number: "0", summary: "Initiele versie", }, ], status: "final", version: "1.0.0", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "bamboo", product: { name: "bamboo", product_id: "CSAFPID-716889", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "bitbucket", product: { name: "bitbucket", product_id: "CSAFPID-344199", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "confluence", product: { name: "confluence", product_id: "CSAFPID-551338", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:confluence:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "crowd", product: { name: "crowd", product_id: "CSAFPID-344399", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*", }, }, }, { category: "product_name", name: "jira_service_management", product: { name: "jira_service_management", product_id: "CSAFPID-343852", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", }, }, }, { category: "product_name", name: "jira_service_management", product: { name: "jira_service_management", product_id: "CSAFPID-343851", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", }, }, }, { category: "product_name", name: "jira", product: { name: "jira", product_id: "CSAFPID-98204", product_identification_helper: { cpe: "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", }, }, }, ], category: "vendor", name: "atlassian", }, ], }, vulnerabilities: [ { cve: "CVE-2017-7656", cwe: { id: "CWE-444", name: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", }, notes: [ { category: "other", text: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", title: "CWE-444", }, ], references: [ { category: "self", summary: "CVE-2017-7656", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2017/CVE-2017-7656.json", }, ], title: "CVE-2017-7656", }, { cve: "CVE-2017-9735", references: [ { category: "self", summary: "CVE-2017-9735", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2017/CVE-2017-9735.json", }, ], title: "CVE-2017-9735", }, { cve: "CVE-2020-10672", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-10672", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10672.json", }, ], title: "CVE-2020-10672", }, { cve: "CVE-2020-10673", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-10673", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10673.json", }, ], title: "CVE-2020-10673", }, { cve: "CVE-2020-10968", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-10968", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10968.json", }, ], title: "CVE-2020-10968", }, { cve: "CVE-2020-10969", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-10969", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-10969.json", }, ], title: "CVE-2020-10969", }, { cve: "CVE-2020-11111", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-11111", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11111.json", }, ], title: "CVE-2020-11111", }, { cve: "CVE-2020-11112", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-11112", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11112.json", }, ], title: "CVE-2020-11112", }, { cve: "CVE-2020-11113", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-11113", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11113.json", }, ], title: "CVE-2020-11113", }, { cve: "CVE-2020-24616", references: [ { category: "self", summary: "CVE-2020-24616", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-24616.json", }, ], title: "CVE-2020-24616", }, { cve: "CVE-2020-35728", cwe: { id: "CWE-96", name: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", title: "CWE-96", }, ], references: [ { category: "self", summary: "CVE-2020-35728", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-35728.json", }, ], title: "CVE-2020-35728", }, { cve: "CVE-2020-36179", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36179", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36179.json", }, ], title: "CVE-2020-36179", }, { cve: "CVE-2020-36180", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36180", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36180.json", }, ], title: "CVE-2020-36180", }, { cve: "CVE-2020-36181", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36181", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36181.json", }, ], title: "CVE-2020-36181", }, { cve: "CVE-2020-36182", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36182", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36182.json", }, ], title: "CVE-2020-36182", }, { cve: "CVE-2020-36184", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36184", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36184.json", }, ], title: "CVE-2020-36184", }, { cve: "CVE-2020-36188", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2020-36188", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-36188.json", }, ], title: "CVE-2020-36188", }, { cve: "CVE-2021-28165", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, notes: [ { category: "other", text: "Uncontrolled Resource Consumption", title: "CWE-400", }, ], references: [ { category: "self", summary: "CVE-2021-28165", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-28165.json", }, ], title: "CVE-2021-28165", }, { cve: "CVE-2022-25647", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2022-25647", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-25647.json", }, ], title: "CVE-2022-25647", }, { cve: "CVE-2022-41966", cwe: { id: "CWE-502", name: "Deserialization of Untrusted Data", }, notes: [ { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, { category: "other", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, ], references: [ { category: "self", summary: "CVE-2022-41966", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-41966.json", }, ], title: "CVE-2022-41966", }, { cve: "CVE-2022-42003", cwe: { id: "CWE-404", name: "Improper Resource Shutdown or Release", }, notes: [ { category: "other", text: "Improper Resource Shutdown or Release", title: "CWE-404", }, { category: "other", text: "Deserialization of Untrusted Data", title: "CWE-502", }, ], references: [ { category: "self", summary: "CVE-2022-42003", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-42003.json", }, ], title: "CVE-2022-42003", }, { cve: "CVE-2023-4759", references: [ { category: "self", summary: "CVE-2023-4759", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4759.json", }, ], title: "CVE-2023-4759", }, { cve: "CVE-2023-34396", references: [ { category: "self", summary: "CVE-2023-34396", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-34396.json", }, ], title: "CVE-2023-34396", }, { cve: "CVE-2023-41835", cwe: { id: "CWE-913", name: "Improper Control of Dynamically-Managed Code Resources", }, notes: [ { category: "other", text: "Improper Control of Dynamically-Managed Code Resources", title: "CWE-913", }, ], references: [ { category: "self", summary: "CVE-2023-41835", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-41835.json", }, ], title: "CVE-2023-41835", }, { cve: "CVE-2023-45859", cwe: { id: "CWE-281", name: "Improper Preservation of Permissions", }, notes: [ { category: "other", text: "Improper Preservation of Permissions", title: "CWE-281", }, ], references: [ { category: "self", summary: "CVE-2023-45859", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45859.json", }, ], title: "CVE-2023-45859", }, { cve: "CVE-2024-1597", cwe: { id: "CWE-89", name: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", }, notes: [ { category: "other", text: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", title: "CWE-89", }, ], references: [ { category: "self", summary: "CVE-2024-1597", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-1597.json", }, ], title: "CVE-2024-1597", }, { cve: "CVE-2024-21634", cwe: { id: "CWE-770", name: "Allocation of Resources Without Limits or Throttling", }, notes: [ { category: "other", text: "Allocation of Resources Without Limits or Throttling", title: "CWE-770", }, ], references: [ { category: "self", summary: "CVE-2024-21634", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21634.json", }, ], title: "CVE-2024-21634", }, { cve: "CVE-2024-21683", references: [ { category: "self", summary: "CVE-2024-21683", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21683.json", }, ], title: "CVE-2024-21683", }, { cve: "CVE-2024-22257", cwe: { id: "CWE-284", name: "Improper Access Control", }, notes: [ { category: "other", text: "Improper Access Control", title: "CWE-284", }, ], references: [ { category: "self", summary: "CVE-2024-22257", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22257.json", }, ], title: "CVE-2024-22257", }, { cve: "CVE-2024-22262", cwe: { id: "CWE-601", name: "URL Redirection to Untrusted Site ('Open Redirect')", }, notes: [ { category: "other", text: "URL Redirection to Untrusted Site ('Open Redirect')", title: "CWE-601", }, ], references: [ { category: "self", summary: "CVE-2024-22262", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22262.json", }, ], title: "CVE-2024-22262", }, { cve: "CVE-2024-23672", cwe: { id: "CWE-459", name: "Incomplete Cleanup", }, notes: [ { category: "other", text: "Incomplete Cleanup", title: "CWE-459", }, ], references: [ { category: "self", summary: "CVE-2024-23672", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23672.json", }, ], title: "CVE-2024-23672", }, { cve: "CVE-2024-24549", cwe: { id: "CWE-20", name: "Improper Input Validation", }, notes: [ { category: "other", text: "Improper Input Validation", title: "CWE-20", }, ], references: [ { category: "self", summary: "CVE-2024-24549", url: "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24549.json", }, ], title: "CVE-2024-24549", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.