Skip to content
OpenAdvisories
High WID-SEC-2024-1214 5 CVEs

Atlassian Jira Software (Data Center und Server): Mehrere Schwachstellen

Published May 21, 2024 · Updated May 21, 2024 · de-DE

Vendor: Atlassian Product: Jira Software Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Atlassian Jira Software Data Center und Server ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen oder Daten zu manipulieren.

Product

Jira ist eine Webanwendung zur Softwareentwicklung.

Vulnerabilities 5

  • Critical 10.0
    CVE-2024-1597

    pgjdbc SQL Injection via line comment generation

    pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

    pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven
  • High 8.2
    CVE-2022-41966 Public exploit

    XStream Denial of Service via stack overflow

    XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • High 8.2
    CVE-2024-22257

    Erroneous authentication pass in Spring Security

    In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the Au…

    org.springframework.security:spring-security-core Maven
  • High 7.7
    CVE-2022-25647 EPSS 12%

    Deserialization of Untrusted Data

    The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

    openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  • Medium 6.3
    CVE-2024-23672

    Apache Tomcat: WebSocket DoS with incomplete closing handshake

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References