Auth bypass in Atlassian Bamboo
CVE-2022-26136
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used…
EPSS: 0.050 (91.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Atlassian Bamboo
- Atlassian Bamboo Data Center — versions unspecified, 8.1.0, 8.2.0
- Atlassian Bamboo Server — versions unspecified, 8.1.0, 8.2.0
- Atlassian Bitbucket — versions 8.0.0, 8.1.0
- Atlassian Bitbucket Data Center — versions unspecified, 7.7.0, 7.16.0
- Atlassian Bitbucket Server — versions unspecified, 7.7.0, 7.16.0
- Atlassian Confluence Data Center — versions unspecified, 7.5.0, 7.14.0
- Atlassian Confluence_data_center — versions 7.18.0
- Atlassian Confluence Server — versions unspecified, 7.5.0, 7.14.0
- Atlassian Confluence_server — versions 7.18.0
Weakness classification (CWE)
References
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@atlassian.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-26136?
- CVE-2022-26136 is a critical-severity vulnerability in Atlassian Bamboo, classified under CWE-180. CVSS score: 9.8/10. Published 2022-07-20.
- How severe is CVE-2022-26136?
- Critical severity. CVSS v3 base score is 9.8 out of 10.