Atlassian Nov 2024 Security Bulletin: Bamboo RCE and DoS/XSS in Jira/Confluence/Bitbucket

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Number of Vulnerabilities: 19 high-severity vulnerabilities were reported in the security advisories for November 2024. 2. Vulnerability Types: - Remote Code Execution (RCE): Found in Bamboo Data Center and Server. - Denial of Service (DoS): Found in Bitbucket Data Center and Server, Confluence Data Center and Server, Jira Data Center and Server, Jira Service Management Data Center and Server, Crowd Data Center, and Sourcetree for Mac and Sourcetree for Windows. - Cross-Site Scripting (XSS): Found in Jira Core Data Center and Server. 3. Affected Versions: - Bamboo Data Center and Server: Versions 10.0.0 to 10.0.2, 9.6.0 to 9.6.7 (LTS), 9.2.1 to 9.2.19 (LTS). - Bitbucket Data Center and Server: Versions 8.19.0 to 8.19.2 (LTS), 8.18.0 to 8.18.1, 8.17.0 to 8.17.2, 8.16.0 to 8.16.4, 8.15.0 to 8.15.5, 8.14.0 to 8.14.6, 8.13.0 to 8.13.6, 8.12.0 to 8.12.6, 8.11.0 to 8.11.6, 8.10.0 to 8.10.6, 8.9.0 to 8.9.13 (LTS), 8.8.0 to 8.8.7, 8.7.0 to 8.7.5, 8.6.2 to 8.6.4, 8.5.2 to 8.5.4, 8.4.3 to 8.4.4, 8.3.4. - Confluence Data Center and Server: Versions 9.1.0 to 9.0.3, 8.9.0 to 8.9.7, 8.8.0 to 8.8.1, 8.7.1 to 8.7.2, 8.6.0 to 8.6.2, 8.5.0 to 8.5.16 (LTS), 8.4.0 to 8.4.5, 8.3.0 to 8.3.4, 8.2.0 to 8.2.3, 8.1.0 to 8.1.4, 8.0.0 to 8.0.4, 7.20.3, 7.19.4 to 7.19.28 (LTS). - Crowd Data Center: Versions 6.0.0 to 6.0.2, 5.3.0 to 5.3.5, 5.2.0 to 5.2.10, 5.1.1 to 5.1.13. - Jira Data Center and Server: Versions 10.0.0 to 10.0.1, 9.17.0 to 9.17.3, 9.12.0 to 9.12.14 (LTS), 9.4.1 to 9.4.27 (LTS). - Jira Service Management Data Center and Server: Versions 10.0.0 to 10.0.1, 5.17.0 to 5.17.3, 5.16.0 to 5.16.1, 5.15.2, 5.14.0 to 5.14.1, 5.13.0 to 5.13.1, 5.12.0 to 5.12.14 (LTS), 5.11.0 to 5.11.3, 5.10.0 to 5.10.2, 5.9.0 to 5.9.2, 5.8.0 to 5.8.2, 5.7.0 to 5.7.2, 5.6.0, 5.5.0 to 5.5.1, 5.4.1 to 5.4.27 (LTS), 5.3.2 to 5.3.3, 5.2.1. - Sourcetree for Mac: Version 4.2.8. - Sourcetree for Windows: Version 3.4.19. 4. Remediation Recommendation: Atlassian recommends updating affected products to the latest version or to a recommended Long-Term Support (LTS) version. 5. Frequently Asked Questions: - Specific versions not listed in the fixed versions: Possibly using unsupported versions; recommend updating to the latest version or an LTS version. - Latest version: Check the software download portal or product-specific download page. - LTS version not updated: May not have been updated or backend fix may not be feasible; recommend updating to the latest version. - Feedback: Feedback on the advisory can be provided. 6. Last Updated Date: November 22, 2024. This information helps users understand which products and versions are affected by high-severity vulnerabilities and guides them in taking appropriate remedial actions.

Goal Reached Thanks to every supporter — we hit 100%!

Atlassian Nov 2024 Security Bulletin: Bamboo RCE and DoS/XSS in Jira/Confluence/Bitbucket