CVE-2024-21682: Code Injection
First published: Tue Feb 20 2024(Updated: )
This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network. This Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation). This vulnerability was reported via our Penetration Testing program.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Assets Discovery Data Center | >=1.0.0<6.2.1 | |
| Atlassian Assets Discovery | >=1.0<6.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html
- https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606
- https://jira.atlassian.com/browse/JSDSERVER-15067
- https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation
Frequently Asked Questions
What is the severity of CVE-2024-21682?
The severity of CVE-2024-21682 is classified as High.
How do I fix CVE-2024-21682?
To fix CVE-2024-21682, upgrade the Assets Discovery tool to version 6.2.1 or later.
What versions are affected by CVE-2024-21682?
CVE-2024-21682 affects Assets Discovery versions 1.0.0 to 6.2.0.
What type of vulnerability is CVE-2024-21682?
CVE-2024-21682 is an Injection vulnerability.
Is CVE-2024-21682 present in both Cloud and Data Center versions?
Yes, CVE-2024-21682 is present in both Cloud and Data Center versions of Assets Discovery.
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/event
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/atlassian
- canonical/atlassian assets discovery data center
- version/atlassian assets discovery data center/1.0.0
- canonical/atlassian assets discovery