The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authentication is provided). The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6.6, 4.0.12, 5.0.5; for Bamboo 2.5.9, 3.6.6, 4.0.12, 5.0.5; and for Fisheye 2.5.9.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wiki.resolution.de/doc/saml-sso/5.0.x/all/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known - Third Party Advisory |
11 Aug 2021, 13:53
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 | |
| References | (MISC) https://wiki.resolution.de/doc/saml-sso/5.0.x/all/security-advisories/2021-07-29-authentication-bypass-network-attacker-can-login-to-users-accounts-when-usernames-are-known - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CPE | cpe:2.3:a:atlassian:saml_single_sign_on:*:*:*:*:*:bamboo:*:* cpe:2.3:a:atlassian:saml_single_sign_on:*:*:*:*:*:jira:*:* cpe:2.3:a:atlassian:saml_single_sign_on:*:*:*:*:*:bitbucket:*:* cpe:2.3:a:atlassian:saml_single_sign_on:*:*:*:*:*:confluence:*:* cpe:2.3:a:atlassian:saml_single_sign_on:*:*:*:*:*:fisheye:*:* |
02 Aug 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-02 19:15
Updated : 2024-11-21 06:15
NVD link : CVE-2021-37843
Mitre link : CVE-2021-37843
CVE.ORG link : CVE-2021-37843
JSON object : View
Products Affected
atlassian
- saml_single_sign_on
CWE
CWE-306
Missing Authentication for Critical Function