Homepage
About Snyk

Access Restriction Bypass Affecting com.atlassian.connect:atlassian-connect-spring-boot-core package, versions [1.1.0,2.1.3) [2.1.4,2.1.5)

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.12% (46th percentile)
Expand this section
NVD
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-COMATLASSIANCONNECT-1310997
  • published 17 Jun 2021
  • disclosed 16 Jun 2021
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 16 Jun 2021

CVE-2021-26077 Open this link in a new tab
CWE-287 Open this link in a new tab

How to fix?

Upgrade com.atlassian.connect:atlassian-connect-spring-boot-core to version 2.1.3, 2.1.5 or higher.

Overview

com.atlassian.connect:atlassian-connect-spring-boot-core is a Java Spring Boot package for building Atlassian Connect apps.

Affected versions of this package are vulnerable to Access Restriction Bypass. It erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.