confluence.atlassian.com
Open in
urlscan Pro
2600:9000:2449:9600:15:77aa:5e80:93a1
Public Scan
Submitted URL: https://confluence.atlassian.com/pages/viewpage.action?pageId=1409286211
Effective URL: https://confluence.atlassian.com/security/security-bulletin-june-18-2024-1409286211.html
Submission: On June 18 via manual from US — Scanned from DE
Effective URL: https://confluence.atlassian.com/security/security-bulletin-june-18-2024-1409286211.html
Submission: On June 18 via manual from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form>
<radiogroup>
<div class="reason-radio-box">
<label><input type="radio" name="was-this-helpful-no-reason" value="It wasn't accurate"> It wasn't accurate</label>
</div>
<div class="reason-radio-box">
<label><input type="radio" name="was-this-helpful-no-reason" value="It wasn't clear"> It wasn't clear</label>
</div>
<div class="reason-radio-box">
<label><input type="radio" name="was-this-helpful-no-reason" value="It wasn't relevant"> It wasn't relevant</label>
</div>
</radiogroup>
</form>Text Content
* Products
* Resources
* Search
* Log in
* * View account
* View requests
* Log out
* ...
PRODUCTS
* JIRA SOFTWARE
Project and issue tracking
* JIRA SERVICE MANAGEMENT
Service management and customer support
* JIRA WORK MANAGEMENT
Manage any business project
* CONFLUENCE
Document collaboration
* BITBUCKET
Git code management
See all
RESOURCES
* DOCUMENTATION
Usage and admin help
* COMMUNITY
Answers, support, and inspiration
* SYSTEM STATUS
Cloud services health
* SUGGESTIONS AND BUGS
Feature suggestions and bug reports
* MARKETPLACE
Product apps
* BILLING AND LICENSING
Frequently asked questions
* Log out
* Log in to account
* Contact support
* Training & Certification
* Cloud Migration Center
* GDPR guides
* Enterprise services
* Atlassian partners
* Developers
* User groups
* Automation for Jira
* Atlassian.com
* PAGE
* View in Confluence
* Edit Page
* VIEWPORT
* Manage Viewport
* CONFLUENCE
* Dashboard
* Space Directory
* People Directory
Security
Documentation
*
Articles
*
Data Center security checklist and best practices
*
Announcement: Planned changes to the Security Bug Fix Policy
*
Security Advisories & Bulletins
*
Security Bulletin - June 18 2024
*
Security Bulletin - May 21 2024
*
Security Bulletin - April 16 2024
*
Security Bulletin - March 19 2024
*
Security Bulletin - February 20 2024
*
Security Bulletin - January 16 2024
*
January 2024: Security Advisories Overview
*
Security Bulletin - December 12 2023
*
December 2023: Security Advisories Overview
*
Security Bulletin - November 21 2023
*
November 2023: Security Advisories Overview
*
Security Bulletin - October 17 2023
*
October 2023: Security Advisories Overview
*
Security Bulletin - September 19 2023
*
Security Bulletin - August 15 2023
*
Security Bulletin - July 18 2023
*
November 2022: Atlassian Security Advisories Overview
*
August 2022: Atlassian Security Advisories Overview
*
July 2022: Atlassian Security Advisories Overview
*
January 2023: Security Advisories Overview
*
CVE-2019-13990 - XXE (XML External Entity Injection) Vulnerability In
Jira Service Management Data Center and Jira Service Management Server
*
CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple
Products
*
CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and
Confluence Server
*
CVE-2023-22523 - RCE Vulnerability in Assets Discovery
*
CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS
*
CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence
Data Center and Confluence Server
*
Archived Security Advisories
*
CVE-2021-42574 - Unrendered unicode bidirectional override characters
in Cloud sites
*
CVE-2023-46604 - Apache ActiveMQ RCE Vulnerability impacts Bamboo Data
Center and Server
*
CVE-2023-22518 - Improper Authorization Vulnerability In Confluence
Data Center and Server
*
CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data
Center and Server
*
Multiple Products Security Advisory - Git Buffer Overflow -
CVE-2022-41903, CVE-2022-23521
*
Multiple Products Security Advisory - CVE-2022-26136, CVE-2022-26137
*
Multiple Products Security Advisory - Hazelcast Vulnerable To Remote
Code Execution - CVE-2016-10750, CVE-2022-26133
*
Local Privilege Escalation via DLL Hijack in Confluence Server on
Windows Installations
*
CVE-2021-26077 - Broken authentication in Atlassian Connect Spring Boot
(ACSB)
*
CVE-2021-26074 - Broken authentication in Atlassian Connect Spring Boot
(ACSB)
*
CVE-2021-26073 - Broken authentication in Atlassian Connect Express
(ACE)
*
CVE-2019-20903 - XSS in atlaskit/editor-core
*
Multiple Products Security Advisory - Log4j Vulnerable To Remote Code
Execution - CVE-2021-44228
*
Atlassian Products & Services and CVE-2018-11235 & CVE-2018-11233
*
Multiple Products Security Advisory - Unrendered unicode bidirectional
override characters - CVE-2021-42574
*
Resources by product
* Atlassian Support
* Documentation
* Security
* Articles
* Security Advisories & Bulletins
* Security Bulletin - June 18 2024
SECURITY BULLETIN - JUNE 18 2024
SECURITY ADVISORIES & BULLETINS
* Security Bulletin - June 18 2024
* Security Bulletin - May 21 2024
* Security Bulletin - April 16 2024
* Security Bulletin - March 19 2024
* Security Bulletin - February 20 2024
* Security Bulletin - January 16 2024
* January 2024: Security Advisories Overview
* Security Bulletin - December 12 2023
* December 2023: Security Advisories Overview
* Security Bulletin - November 21 2023
* November 2023: Security Advisories Overview
* Security Bulletin - October 17 2023
* October 2023: Security Advisories Overview
* Security Bulletin - September 19 2023
* Security Bulletin - August 15 2023
* Security Bulletin - July 18 2023
* November 2022: Atlassian Security Advisories Overview
* August 2022: Atlassian Security Advisories Overview
* July 2022: Atlassian Security Advisories Overview
* January 2023: Security Advisories Overview
* CVE-2019-13990 - XXE (XML External Entity Injection) Vulnerability In Jira
Service Management Data Center and Jira Service Management Server
* CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple Products
* CVE-2023-22522 - RCE Vulnerability In Confluence Data Center and Confluence
Server
* CVE-2023-22523 - RCE Vulnerability in Assets Discovery
* CVE-2023-22524 - RCE Vulnerability in Atlassian Companion App for MacOS
* CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data
Center and Confluence Server
* Archived Security Advisories
ON THIS PAGE
STILL NEED HELP?
The Atlassian Community is here for you.
Ask the community
JUNE 2024 SECURITY BULLETIN
The vulnerabilities reported in this Security Bulletin include 9 high-severity
vulnerabilities which have been fixed in new versions of our products, released
in the last month. These vulnerabilities are discovered via our Bug Bounty
program, pen-testing processes, and third-party library scans.
To fix all the vulnerabilities impacting your product(s), Atlassian recommends
patching your instances to the latest version or one of the Fixed Versions for
each product below. The listed Fixed Versions for each product are current as of
June 18, 2024 (date of publication); visit the linked product Release Notes for
the most up-to-date versions.
NOTE: The vulnerabilities included in monthly Security Bulletins present a lower
impact than those published via Critical Security Advisories. Customers can
expect to receive those high-priority patches outside of our monthly schedule as
necessary.
To search for CVEs or check your product versions for disclosed vulnerabilities,
check the Vulnerability Disclosure Portal.
Released Security VulnerabilitiesProduct & Release NotesAffected VersionsFixed
VersionVulnerability SummaryCVE IDCVSS SeverityConfluence Data Center and Server
* 8.9.0 to 8.9.2
* 8.8.0 to 8.8.1
* 8.7.1 to 8.7.2
* 8.6.0 to 8.6.2
* 8.5.0 to 8.5.10 (LTS)
* 8.4.0 to 8.4.5
* 8.3.0 to 8.3.4
* 8.2.0 to 8.2.3
* 8.1.0 to 8.1.4
* 8.0.0 to 8.0.4
* 7.20.0 to 7.20.3
* 7.19.0 to 7.19.23 (LTS)
* 8.9.3 Data Center Only
* 8.5.11 (LTS) recommended
* 7.19.24 (LTS)
Improper Authorization org.springframework.security:spring-security-core
Dependency in Confluence Data Center and ServerCVE-2024-222578.2 HighSSRF
(Server-Side Request Forgery) org.springframework:spring-web Dependency in
Confluence Data Center and ServerCVE-2024-222438.1 HighSSRF (Server-Side Request
Forgery) org.springframework:spring-web Dependency in Confluence Data Center and
ServerCVE-2024-222628.1 HighSSRF (Server-Side Request Forgery)
org.springframework:spring-web Dependency in Confluence Data Center and
ServerCVE-2024-222598.1 HighDoS (Denial of Service)
org.apache.commons:commons-configuration2 Dependency in Confluence Data Center
and ServerCVE-2024-291337.5 HighDoS (Denial of Service)
org.apache.commons:commons-configuration2 Dependency in Confluence Data Center
and ServerCVE-2024-291317.5 HighFisheye/Crucible
* 4.8.10 to 4.8.14
* 4.8.15 recommended
DoS (Denial of Service) com.google.code.gson:gson Dependency in Crucible Data
Center and ServerCVE-2022-256477.5 HighJira Data Center and Server
* 9.12.0 to 9.12.7 (LTS)
* 9.4.0 to 9.4.20 (LTS)
* 9.16.0 to 9.16.1 Data Center Only
* 9.12.8 to 9.12.10 (LTS) recommended
* 9.4.21 to 9.4.23 (LTS)
Information Disclosure in Jira Core Data CenterCVE-2024-216857.4 HighJira
Service Management Data Center and Server
* 5.15.2
* 5.12.0 to 5.12.7 (LTS)
* 5.4.0 to 5.4.20 (LTS)
* 5.16.0 to 5.16.1 Data Center Only
* 5.12.8 to 5.12.10 (LTS) recommended
* 5.4.21 to 5.4.23 (LTS)
Information Disclosure in Jira Service Management Data Center and
ServerCVE-2024-216857.4 High
FREQUENTLY ASKED QUESTIONS:
* Why is my Feature Version not listed in a Fixed Version? You may be using an
unsupported version and need to patch to the latest version or Long-Term
Support (LTS) version.
* What are the most up-to-date Data Center product versions? You can always
check the software download portal or visit the product-specific download
pages.
* Jira Software Data Center
* Jira Service Management
* Confluence Data Center
* Bitbucket Data Center
* Bamboo Data Center
* Crowd Data Center
* I am using an LTS, why is it not listed in the Fixed Versions? Your LTS
version may not have been updated yet or a backported fix may not have been
feasible. Please see our Security Bug Fix Policy for more information. We
recommend upgrading your products to the latest versions. For the latest
fixed versions, visit the release notes linked in the vulnerability table.
* Questions about the bulletin, have feedback? Let us know! Read more about our
bulletins and feel free to contribute feedback on our latest Community Post
To search for CVEs or check your products versions for disclosed
vulnerabilities, check the Vulnerability Disclosure Portal.
Last modified on Jun 18, 2024
Was this helpful?
Yes
No
It wasn't accurate
It wasn't clear
It wasn't relevant
Provide feedback about this article
Powered by Confluence and Scroll Viewport.
Atlassian
* Your Privacy Choices
* Privacy Policy
* Terms of Use
* Security
* © 2024 Atlassian
This site uses cookies to improve your browsing experience, perform analytics
and research, and conduct advertising. To change your preferences, click Manage
preferences. Otherwise, clicking Accept all cookies indicates you agree to our
use of cookies on your device. Clicking Reject all cookies means you do not
agree to our use of non-strictly necessary cookies on your device.Atlassian
Cookies and Tracking Notice
Manage preferences Reject all cookies Accept all cookies
MANAGE PREFERENCES
When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Accept all
STRICTLY NECESSARY COOKIES
Always Active
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.
TARGETING COOKIES
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They are based on uniquely identifying your
browser and internet device. If you do not allow these cookies, you will
experience less targeted advertising.
FUNCTIONAL COOKIES
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.
PERFORMANCE COOKIES
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. If you do not
allow these cookies we will not know when you have visited our site, and will
not be able to monitor its performance.
Back Button
COOKIE LIST
Search Icon
Filter Icon
Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
Reject all Confirm my choices