Jira Software Server
Monthly
An unauthenticated arbitrary file access vulnerability affects a broad set of Atlassian Data Center and Server products - Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye - allowing a remote attacker to retrieve specific files that reside inside the web application root directory. Exploitation requires the attacker to already know the exact file name and full path of the target; the flaw provides no directory enumeration or listing capability, so it cannot be used to discover files opportunistically. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and impact is configuration-dependent because meaningful damage only occurs when sensitive files such as secret- or credential-bearing configurations sit inside the reachable web root; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
An unauthenticated arbitrary file access vulnerability affects a broad set of Atlassian Data Center and Server products - Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye - allowing a remote attacker to retrieve specific files that reside inside the web application root directory. Exploitation requires the attacker to already know the exact file name and full path of the target; the flaw provides no directory enumeration or listing capability, so it cannot be used to discover files opportunistically. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and impact is configuration-dependent because meaningful damage only occurs when sensitive files such as secret- or credential-bearing configurations sit inside the reachable web root; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).