Atlassian fixed six high-severity bugs in Confluence Data Center and Server

Pierluigi Paganini June 20, 2024

Australian software company Atlassian addressed multiple high-severity vulnerabilities in its Confluence, Crucible, and Jira solutions.

addressed nine high-severity vulnerabilities in Confluence, Crucible, and Jira products.

The most severe issue addressed by the company is an improper authorization org.springframework.security:spring-security-core dependency in Confluence Data Center and Server. The flaw tracked as received a CVSS score of 8.2.

The Confluence Data Center and Server update resolved other five SSRF (Server-Side Request Forgery) and DoS vulnerabilities. Below is the list of the addressed flaws:

Released Security Vulnerabilities
Product & Release NotesAffected VersionsFixed VersionVulnerability SummaryCVE IDCVSS Severity
8.9.0 to 8.9.28.8.0 to 8.8.18.7.1 to 8.7.28.6.0 to 8.6.28.5.0 to 8.5.10 (LTS)8.4.0 to 8.4.58.3.0 to 8.3.48.2.0 to 8.2.38.1.0 to 8.1.48.0.0 to 8.0.47.20.0 to 7.20.37.19.0 to 7.19.23 (LTS)8.9.3 Data Center Only8.5.11 (LTS) recommended7.19.24 (LTS)8.2 High
8.1 High
8.1 High
8.1 High
7.5 High
7.5 High

Confluence Data Center and Server versions 8.9.3, 8.5.11 (LTS), and 7.19.24 (LTS) addressed these vulnerabilities.

Atlassian also fixed a DoS vulnerability, tracked as , in the Fisheye/Crucible with the release of version 4.8.15.

The software firm also fixed the following vulnerabilities in the Jira Data Center and Server:

9.12.0 to 9.12.7 (LTS)9.4.0 to 9.4.20 (LTS)9.16.0 to 9.16.1 Data Center Only9.12.8 to 9.12.10 (LTS) recommended9.4.21 to 9.4.23 (LTS)7.4 High
5.15.25.12.0 to 5.12.7 (LTS)5.4.0 to 5.4.20 (LTS)5.16.0 to 5.16.1 Data Center Only5.12.8 to 5.12.10 (LTS) recommended5.4.21 to 5.4.23 (LTS)7.4 High

The company is not aware of attacks in the wild exploiting the vulnerabilities fixed in the June 2024 .

Follow me on Twitter:  and  and Mastodon

(SecurityAffairs – hacking, China)



you might also like

leave a comment