CVE-2021-37843: Critical severity Atlassian Saml Single Sign On Bamboo vulnerability

Q: What is the severity of CVE-2021-37843?

CVE-2021-37843 has a critical severity level due to the potential for remote attackers to exploit it without requiring any additional authentication beyond knowing the username.

Q: How do I fix CVE-2021-37843?

To fix CVE-2021-37843, update your Atlassian SAML SSO apps to the fixed versions: Jira 3.6.6.1, 4.0.12, 5.0.5; Confluence 3.6.6, 4.0.12, 5.0.5; Bitbucket 2.5.9, 3.6.6.

Q: What systems are affected by CVE-2021-37843?

CVE-2021-37843 affects multiple Atlassian products utilizing the SAML SSO apps, including Jira, Confluence, Bitbucket, and FishEye.

Q: What is the impact of CVE-2021-37843 if exploited?

Exploiting CVE-2021-37843 allows an attacker to gain unauthorized access to a user account solely with knowledge of the username.

Q: Are there any workarounds for CVE-2021-37843?

As of now, there are no known workarounds for CVE-2021-37843, and patching to the latest versions is the recommended solution.

Published Aug 2, 2021

Updated

The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authentication is provided). The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6.6, 4.0.12, 5.0.5; for Bamboo 2.5.9, 3.6.6, 4.0.12, 5.0.5; and for Fisheye 2.5.9.

Affected Software

16 affected components

Atlassian Saml Single Sign On Bamboo<2.5.9

Atlassian Saml Single Sign On Bitbucket<2.5.9

Atlassian Saml Single Sign On Fisheye<2.5.9

Atlassian Saml Single Sign On Confluence<3.5.6

Atlassian Saml Single Sign On Jira<3.6.6.1

Atlassian Saml Single Sign On Bamboo>=3.0.0<3.6.6

Atlassian Saml Single Sign On Bitbucket>=3.0.0<3.6.6

Atlassian Saml Single Sign On Confluence>=3.6.0<3.6.6.1

Atlassian Saml Single Sign On Bamboo>=4.0.0<4.0.12

Atlassian Saml Single Sign On Bitbucket>=4.0.0<4.0.12

Atlassian Saml Single Sign On Confluence>=4.0.0<4.0.12

Atlassian Saml Single Sign On Jira>=4.0.0<4.0.12

Atlassian Saml Single Sign On Bamboo>=5.0.0<5.0.5

Atlassian Saml Single Sign On Bitbucket>=5.0.0<5.0.5

Atlassian Saml Single Sign On Confluence>=5.0.0<5.0.5

Atlassian Saml Single Sign On Jira>=5.0.0<5.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Jira to a version that resolves this vulnerability.
Fixed in 3.6.6.1
Upgrade
Upgrade Jira to a version that resolves this vulnerability.
Fixed in 4.0.12
Upgrade
Upgrade Jira to a version that resolves this vulnerability.
Fixed in 5.0.5
Upgrade
Upgrade Confluence to a version that resolves this vulnerability.
Fixed in 3.6.6
Upgrade
Upgrade Confluence to a version that resolves this vulnerability.
Fixed in 4.0.12
Upgrade
Upgrade Confluence to a version that resolves this vulnerability.
Fixed in 5.0.5
Upgrade
Upgrade Bitbucket to a version that resolves this vulnerability.
Fixed in 2.5.9
Upgrade
Upgrade Bitbucket to a version that resolves this vulnerability.
Fixed in 3.6.6
Upgrade
Upgrade Bitbucket to a version that resolves this vulnerability.
Fixed in 4.0.12
Upgrade
Upgrade Bitbucket to a version that resolves this vulnerability.
Fixed in 5.0.5
Upgrade
Upgrade Bamboo to a version that resolves this vulnerability.
Fixed in 2.5.9
Upgrade
Upgrade Bamboo to a version that resolves this vulnerability.
Fixed in 3.6.6
Upgrade
Upgrade Bamboo to a version that resolves this vulnerability.
Fixed in 4.0.12
Upgrade
Upgrade Bamboo to a version that resolves this vulnerability.
Fixed in 5.0.5
Upgrade
Upgrade Fisheye to a version that resolves this vulnerability.
Fixed in 2.5.9

Event History

Aug 2, 2021

CVE Published

via MITRE·06:47 PM

Data Sourced

via MITRE·06:47 PM

DescriptionSeverity

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-37843?

CVE-2021-37843 has a critical severity level due to the potential for remote attackers to exploit it without requiring any additional authentication beyond knowing the username.

How do I fix CVE-2021-37843?