Atlassian Drops Patches for Critical Jira Authentication Bypass Vulnerability

[MuzzMelbourne]

Content source

https://thehackernews.com/2022/04/atlassian-drops-patches-for-critical.html

Atlassian has published a security advisory warning of a critical vulnerability in its Jira software that could be abused by a remote, unauthenticated attacker to circumvent authentication protections. Tracked as CVE-2022-0540, the flaw is rated 9.9 out of 10 on the CVSS scoring system and resides in Jira's authentication framework, Jira Seraph.

Atlassian Drops Patches for Critical Jira Authentication Bypass Vulnerability

 

[upnorth]

It's worth noting that a critical remote code execution flaw in Atlassian Confluence (CVE-2021-26084, CVSS score: 9.8) was actively weaponized in the wild last year to install cryptocurrency miners on compromised servers.

 

[ForgottenSeer 94654]

Atlassian is ripe for escalation bugs and vulnerabilities - especially its vast plug-in store.

Atlassian does have an OK bug bounty program of $200 to $10,000, but the plug-in publishers do not have any as they are third parties and not affiliated nor endorsed by Atlassian. Sounds a lot similar to the Google Play store, right?