This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Atlassian fixes 2 vulnerabilities

Atlassian fixes 2 vulnerabilities in Confluence Data Center and Assets Discovery. Affected products and their fixed versions: Confluence Data Center - 8.8.0, 8.7.2, 8.5.5 , 7.19.18 Assets Discovery - 6.2.1

Atlassian Confluence Data Center - stored XSS (CVE-2024-21678)
CVSS 8.5 (High)

An authenticated remote attacker can execute arbitrary HTML or JavaScript code in the victim's browser [1].

The vulnerability is present in product:

  • Confluence Data Center; <7.19.18; >=7.20.0, <8.5.5; >=8.6.0, <8.7.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 15. 2. 2024.

Atlassian Assets Discovery - Injection (CVE-2024-21682)
CVSS 7.2 (High)

An authenticated remote attacker can alter the actions performed by a system call [2].

The vulnerability is present in product:

  • Assets Discovery; <6.2.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 30. 1. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 26. 2. 2024.

CESNET, z.s.p.o. Logo