Read the docs
TI-2022-09599 Aliases CVE-2022-26137GHSA-fpj5-pcgc-34g7

Origin validation error in Atlassian Bamboo Server

Priority MEDIUM 45CWE-180Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-346.

Summary

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0241 84th percentileScored 2026-11-07
Fix Fixed Bamboo Server (Atlassian): 8.0.9, 8.1.8, 8.2.4Bamboo Data Center (Atlassian): 8.0.9, 8.1.8, 8.2.4+13 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianBamboo Serverbefore 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.48.0.9, 8.1.8, 8.2.4Patch availableCNA
AtlassianBamboo Data Centerbefore 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.48.0.9, 8.1.8, 8.2.4Patch availableCNA
AtlassianBitbucket Serverbefore 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.07.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2Patch availableCNA
AtlassianBitbucket Data Centerbefore 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.07.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2Patch availableCNA
AtlassianConfluence Serverbefore 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.07.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4Patch availableCNA
AtlassianConfluence Data Centerbefore 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.07.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4Patch availableCNA
AtlassianCrowd Serverbefore 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.04.3.8, 4.4.2Patch availableCNA
AtlassianCrowd Data Centerbefore 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.04.3.8, 4.4.2Patch availableCNA
AtlassianCruciblebefore 4.8.104.8.10Patch availableCNA
AtlassianFisheyebefore 4.8.104.8.10Patch availableCNA
AtlassianJira Core Serverbefore 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.48.13.22, 8.20.10, 8.22.4Patch availableCNA
AtlassianJira Software Serverbefore 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.48.13.22, 8.20.10, 8.22.4Patch availableCNA
AtlassianJira Software Data Centerbefore 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.48.13.22, 8.20.10, 8.22.4Patch availableCNA
AtlassianJira Service Management Serverbefore 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.44.13.22, 4.20.10, 4.22.4Patch availableCNA
AtlassianJira Service Management Data Centerbefore 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.44.13.22, 4.20.10, 4.22.4Patch availableCNA
  • Bamboo Server VendorAtlassian Affected before 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.4 Fixed in 8.0.9, 8.1.8, 8.2.4 Patch available CNA
  • Bamboo Data Center VendorAtlassian Affected before 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.4 Fixed in 8.0.9, 8.1.8, 8.2.4 Patch available CNA
  • Bitbucket Server VendorAtlassian Affected before 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.0 Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2 Patch available CNA
  • Bitbucket Data Center VendorAtlassian Affected before 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.0 Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2 Patch available CNA
  • Confluence Server VendorAtlassian Affected before 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.0 Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 Patch available CNA
  • Confluence Data Center VendorAtlassian Affected before 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.0 Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 Patch available CNA
  • Crowd Server VendorAtlassian Affected before 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.0 Fixed in 4.3.8, 4.4.2 Patch available CNA
  • Crowd Data Center VendorAtlassian Affected before 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.0 Fixed in 4.3.8, 4.4.2 Patch available CNA
  • Crucible VendorAtlassian Affected before 4.8.10 Fixed in 4.8.10 Patch available CNA
  • Fisheye VendorAtlassian Affected before 4.8.10 Fixed in 4.8.10 Patch available CNA
  • Jira Core Server VendorAtlassian Affected before 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.4 Fixed in 8.13.22, 8.20.10, 8.22.4 Patch available CNA
  • Jira Software Server VendorAtlassian Affected before 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.4 Fixed in 8.13.22, 8.20.10, 8.22.4 Patch available CNA
  • Jira Software Data Center VendorAtlassian Affected before 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.4 Fixed in 8.13.22, 8.20.10, 8.22.4 Patch available CNA
  • Jira Service Management Server VendorAtlassian Affected before 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.4 Fixed in 4.13.22, 4.20.10, 4.22.4 Patch available CNA
  • Jira Service Management Data Center VendorAtlassian Affected before 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.4 Fixed in 4.13.22, 4.20.10, 4.22.4 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*7.2.0 to before 7.2.10; 8.0.0 to before 8.0.9; 8.1.0 to before 8.1.8; 8.2.0 to before 8.2.4VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*before 7.6.16; 7.7.0 to before 7.17.8; 7.18.0 to before 7.19.5; 7.20.0 to before 7.20.2; 7.21.0 to before 7.21.2VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*7.18.0VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*7.18.0VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*before 4.3.8; 4.4.0 to before 4.4.2VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:* Versions 7.2.0 to before 7.2.10; 8.0.0 to before 8.0.9; 8.1.0 to before 8.1.8; 8.2.0 to before 8.2.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* Versions before 7.6.16; 7.7.0 to before 7.17.8; 7.18.0 to before 7.19.5; 7.20.0 to before 7.20.2; 7.21.0 to before 7.21.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:* Versions 7.18.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:* Versions 7.18.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions before 4.3.8; 4.4.0 to before 4.4.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Atlassian
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*before 4.8.10VulnerableAtlassian
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*before 4.8.10VulnerableAtlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*before 4.13.22VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*before 4.13.22VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*4.14.0 to before 4.20.10VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*4.14.0 to before 4.20.10VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*4.21.0 to before 4.22.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*4.21.0 to before 4.22.4VulnerableAtlassian
  • cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:* Versions before 4.8.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* Versions before 4.8.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions before 4.13.22 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions before 4.13.22 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.14.0 to before 4.20.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.14.0 to before 4.20.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.21.0 to before 4.22.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.21.0 to before 4.22.4 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Bamboo Server (Atlassian) Fixed in 8.0.9, 8.1.8, 8.2.4
  • Fix · CNA Bamboo Data Center (Atlassian) Fixed in 8.0.9, 8.1.8, 8.2.4
  • Fix · CNA Bitbucket Server (Atlassian) Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Fix · CNA Bitbucket Data Center (Atlassian) Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Fix · CNA Confluence Server (Atlassian) Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Fix · CNA Confluence Data Center (Atlassian) Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Fix · CNA Crowd Server (Atlassian) Fixed in 4.3.8, 4.4.2
  • Fix · CNA Crowd Data Center (Atlassian) Fixed in 4.3.8, 4.4.2
  • Fix · CNA Crucible (Atlassian) Fixed in 4.8.10
  • Fix · CNA Fisheye (Atlassian) Fixed in 4.8.10
  • Fix · CNA Jira Core Server (Atlassian) Fixed in 8.13.22, 8.20.10, 8.22.4
  • Fix · CNA Jira Software Server (Atlassian) Fixed in 8.13.22, 8.20.10, 8.22.4
  • Fix · CNA Jira Software Data Center (Atlassian) Fixed in 8.13.22, 8.20.10, 8.22.4
  • Fix · CNA Jira Service Management Server (Atlassian) Fixed in 4.13.22, 4.20.10, 4.22.4
  • Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in 4.13.22, 4.20.10, 4.22.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Atlassian Bamboo Data Center, Bamboo Server and 13 more products 4.13.22, 4.20.10 and 22 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-09598 Improper authentication in Atlassian Bamboo ServerPriority MEDIUM 57
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26137
  2. 2026-10-03 Alias added: GHSA-fpj5-pcgc-34g7

References

Patch 8

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
  • TI-2016-04529 Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict… CVSS 3.0CRITICAL 9.8
  • TI-2015-06881 An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-07936 The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x… CVSS 3.0CRITICAL 9.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences