Menu
Atlassian fixes critical vulnerability in development collaboration products

Atlassian fixes critical vulnerability in development collaboration products

The flaw can be exploited to execute malicious Java code on servers

A critical vulnerability in popular software development collaboration products by Atlassian allows attackers to compromise servers.

The vulnerability affects Atlassian Confluence, a wiki-like collaboration platform for software development teams; Bamboo, a software build and testing platform; FishEye, a code-tracking system for centralizing different repositories; and Crucible, a collaborative peer code review framework.

Attackers can exploit the vulnerability to execute arbitrary Java code on systems that use the affected frameworks, as long as they can access their Web interfaces, the company said in security advisories published Wednesday. To exploit Confluence, the attacker also needs to have access to an account on the platform.

The impact of the vulnerability depends on what data is stored on those systems and what the malicious Java code is designed to do.

Atlassian released patches for all of the affected products. Confluence users are advised to apply the webwork-2.1.5-atlassian-3.jar patch, Bamboo users should apply the freemarker-2.3.16-atlassian-34.jar patch, while FishEye and Crucible users should upgrade to the newly released 3.5.5 or 3.6.2 versions.

If the affected products are not directly accessible from the Internet or other untrusted networks, the risk of compromise is reduced because the attacker would first have to gain access to the same network as the servers hosting them. Companies whose installations need to be accessible from the Internet can block requests in their firewalls that match specific regular expressions released by Atlassian.

Atlassian has over 35,000 customers worldwide, including large Internet and software development companies like Facebook, Twitter, Hulu, eBay, LinkedIn, Twitter, Netflix, Adobe Systems, Microsoft and Cisco Systems.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags patch managementatlassianpatchesExploits / vulnerabilities

Featured

Slideshows

EDGE 2018: Kiwis kick back with Super Rugby before NZ session

EDGE 2018: Kiwis kick back with Super Rugby before NZ session

New Zealanders kick-started EDGE 2018 with a bout of Super Rugby before a dedicated New Zealand session, in front of more than 50 partners, vendors and distributors on Hamilton Island.‚Äč

EDGE 2018: Kiwis kick back with Super Rugby before NZ session
EDGE 2018: Kiwis assess key customer priorities through NZ research

EDGE 2018: Kiwis assess key customer priorities through NZ research

EDGE 2018 kicked off with a dedicated New Zealand track, highlighting the key customer priorities across the local market, in association with Dell EMC. Delivered through EDGE Research - leveraging Kiwi data through Tech Research Asia - more than 50 partners, vendors and distributors combined during an interactive session to assess the changing spending patterns of the end-user and the subsequent impact to the channel.

EDGE 2018: Kiwis assess key customer priorities through NZ research
Show Comments