Access Restriction Bypass Affecting com.atlassian.connect:atlassian-connect-spring-boot-core package, versions [1.1.0,2.1.3) [2.1.4,2.1.5)


0.0
high
  • Attack Complexity

    Low

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-COMATLASSIANCONNECT-1310997

  • published

    17 Jun 2021

  • disclosed

    16 Jun 2021

  • credit

    Unknown

How to fix?

Upgrade com.atlassian.connect:atlassian-connect-spring-boot-core to version 2.1.3, 2.1.5 or higher.

Overview

com.atlassian.connect:atlassian-connect-spring-boot-core is a Java Spring Boot package for building Atlassian Connect apps.

Affected versions of this package are vulnerable to Access Restriction Bypass. It erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.