Atlassian's Jira Service Management Found Vulnerable to Critical Vulnerability

🗓️ 03 Feb 2023 07:55:00Reported by The Hacker NewsType

Jira Service Management has a critical auth flaw CVE-2023-22501 enabling impersonation and signup tokens.

Reporter	Title	Published	Views	Family All 69
zdt	Bitbucket Environment Variable Remote Command Injection Exploit	16 Mar 202300:00	–	zdt
BDU FSTEC	The vulnerability of the REST application programming interface of the Atlassian Crowd data processing software allows a perpetrator to enhance their privileges.	25 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Atlassian Bitbucket Data Center and Bitbucket Server software lies in the lack of measures taken at the management level to clean data, allowing attackers to execute arbitrary code.	30 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Atlassian Jira Service Management and Data Center data processing software, related to authentication errors, allows attackers to escalate their privileges.	8 Feb 202300:00	–	bdu_fstec
Tenable Nessus	Atlassian Bitbucket < 7.6.19 / 7.17.12 / 7.21.6 / 8.0.5 / 8.1.5 / 8.2.4 / 8.3.3 / 8.4.2 Command Injection	18 Jan 202300:00	–	nessus
Tenable Nessus	Atlassian Crowd 3.x / 4.x < 4.4.4 / 5.x < 5.0.3 Security Bypass (CWD-5888)	1 Dec 202200:00	–	nessus
Tenable Nessus	Atlassian JIRA Service Desk 5.3.x < 5.3.3 / 5.4.x < 5.4.2 / 5.5.x < 5.5.1 Impersonation (JSDSERVER-12312)	3 Feb 202300:00	–	nessus
Tenable Nessus	Atlassian Crowd < 4.4.4 Misconfiguration	24 Nov 202200:00	–	nessus
Tenable Nessus	Atlassian Bitbucket < 7.6.19 Command Injection	24 Nov 202200:00	–	nessus
Tenable Nessus	Atlassian Bitbucket 7.7.x < 7.17.12 Command Injection	24 Nov 202200:00	–	nessus

04 Feb 2023 02:29Current

9.8Critical risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 39.4

EPSS0.98076

SSVC