CVE:CVE-2022-26137
CNNVD:CNNVD-202207-2111
Atlassian Crowd和Atlassian Jira都是澳大利亚Atlassian公司的产品。Atlassian Crowd是一套基于Web的单点登录系统。该系统为多用户、网络应用程序和目录服务器提供验证、授权等功能。Atlassian Jira是一套缺陷跟踪管理系统。该系统主要用于对工作中各类问题、缺陷进行跟踪管理。
Atlassian Crowd Server 和 Data Center 存在安全漏洞，未经身份验证的远程攻击者可能会导致调用其他 Servlet 过滤器。
solution:Upgrade atlassian bamboo to a higher version than 7.2.10,8.0.9,8.1.8,8.2.4,and avoid the version [7.2.0,7.2.10),[8.0.0,8.0.9),[8.1.0,8.1.8),[8.2.0,8.2.4); Upgrade atlassian bitbucket to a higher version than 7.6.16,7.17.8,7.19.5,7.20.2,7.21.2,8.0.0,8.1.0,and avoid the version (,7.6.16),[7.7.0,7.17.8),[7.18.0,7.19.5),[7.20.0,7.20.2),[7.21.0,7.21.2),8.0.0,8.1.0; Upgrade atlassian confluence_data_center to a higher version than 7.4.17,7.13.7,7.14.3,7.15.2,7.16.4,7.17.4,7.18.0,and avoid the version (,7.4.17),[7.5.0,7.13.7),[7.14.0,7.14.3),[7.15.0,7.15.2),[7.16.0,7.16.4),[7.17.0,7.17.4),7.18.0; Upgrade atlassian confluence_server to a higher version than 7.4.17,7.13.7,7.14.3,7.15.2,7.16.4,7.17.4,7.18.0,and avoid the version (,7.4.17),[7.5.0,7.13.7),[7.14.0,7.14.3),[7.15.0,7.15.2),[7.16.0,7.16.4),[7.17.0,7.17.4),7.18.0; Upgrade atlassian crowd to a higher version than 4.3.8,4.4.2,5.0.0,and avoid the version (,4.3.8),[4.4.0,4.4.2),5.0.0; Upgrade atlassian crucible to a higher version than 4.8.10,and avoid the version (,4.8.10); Upgrade atlassian fisheye to a higher version than 4.8.10,and avoid the version (,4.8.10); Upgrade atlassian jira_data_center to a higher version than 8.13.22,8.20.10,8.22.4,and avoid the version [8.13.0,8.13.22),[8.14.0,8.20.10),[8.21.0,8.22.4); Upgrade atlassian jira_server to a higher version than 8.13.22,8.20.10,8.22.4,and avoid the version [8.13.0,8.13.22),[8.14.0,8.20.10),[8.21.0,8.22.4); Upgrade atlassian jira_service_desk to a higher version than 4.13.22,and avoid the version (,4.13.22); Upgrade atlassian jira_service_management to a higher version than 4.20.10,4.22.4,and avoid the version [4.14.0,4.20.10),[4.21.0,4.22.4)