Page History
| Warning |
|---|
This is a public space: For the draft, please restrict the page during creation and |
| English | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Dear customer, On Oct 17 2023 10:00 PDT, Atlassian issued a Security Advisory for Jira Service Management Server and Data Center. What you need to knowThe affected versions contain vulnerable versions of Terracotta Quartz Scheduler which allow authenticated attackers to initiate an XML External Entity injection attack using job descriptions. Atlassian has committed to issuing critical advisories based on the NVD vulnerability score, in this case the CVSS for this third party CVE is critical (9.8), but this score doesn’t always account for the context in which a vulnerable component is used in our software. Unauthenticated attackers without local access to the system are unable to exploit this vulnerability. As such, our internal assessment of this vulnerability is scored as high severity. Affected Versions
What should I do?
UpdateLTS Update Package Customers will get contacted to discuss the need of an update. SupportIf you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch. |
| Frenchgerman | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Dear customer, On Oct 17 2023 10:00 PDT, Atlassian issued a Security Advisory for Jira Service Management Server and Data Center. What you need to knowThe affected versions contain vulnerable versions of Terracotta Quartz Scheduler which allow authenticated attackers to initiate an XML External Entity injection attack using job descriptions. Atlassian has committed to issuing critical advisories based on the NVD vulnerability score, in this case the CVSS for this third party CVE is critical (9.8), but this score doesn’t always account for the context in which a vulnerable component is used in our software. Unauthenticated attackers without local access to the system are unable to exploit this vulnerability. As such, our internal assessment of this vulnerability is scored as high severity. Affected Versions
What should I do?
UpdateLTS Update Package Customers will get contacted to discuss the need of an update. SupportIf you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch. | |||||||||||||||||||||||||||||
| German |
| French | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Chère cliente, cher clientDear customer, On Oct Le 17 2023 10:00 PDToctobre 2023 à 19h, Atlassian issued a Security Advisory fora publié un avis de sécurité pour Jira Service Management Server and Serveur & Data Center.The Cloud versions of the applications as well as other Atlassian products are not affected. What you need to knowThe affected versions contain vulnerable versions of Terracotta Quartz Scheduler which allow authenticated attackers to initiate an XML External Entity injection attack using job descriptions. Les versions Cloud des applications ainsi que les autres produits Atlassian ne sont pas concernés. Ce qu'il faut savoirLes versions concernées contiennent des versions vulnérables de Terracotta Quartz Scheduler qui permettent à des attaquants authentifiés d'initier une attaque par injection d'entité externe XML en utilisant des descriptions de tâches. Atlassian s'est engagé à émettre des avis critiques basés sur le score de vulnérabilité NVD, dans ce cas le CVSS pour ce CVE tiers est critique Atlassian has committed to issuing critical advisories based on the NVD vulnerability score, in this case the CVSS for this third party CVE is critical (9.8), but this score doesn’t always account for the context in which a vulnerable component is used in our software. Unauthenticated attackers without local access to the system are unable to exploit this vulnerability. As such, our internal assessment of this vulnerability is scored as high severity. Affected Versionsmais ce score ne prend pas toujours en compte le contexte dans lequel un composant vulnérable est utilisé dans notre logiciel. Les attaquants non authentifiés qui n'ont pas d'accès local au système sont incapables d'exploiter cette vulnérabilité. Par conséquent, notre évaluation interne de cette vulnérabilité est classée comme étant de haute sévérité. Versions affectées
Que dois-je faire ?
UpdateLTS Update Package Customers will get contacted to discuss the need of an update. Support
UpdateLes clients du paquet de mise à jour LTS seront contactés pour discuter de la nécessité d'une mise à jour. SupportSi vous avez encore des questions ou des inquiétudes concernant cet avis, veuillez contacter le support de bitvoodoo via If you still have questions or concerns regarding this advisory, please contact the bitvoodoo support via support.bitvoodoo.ch. |
