Atlassian Alerts Users to Multiple Critical Vulnerabilities Affecting Data Center Server

Atlassian has released its May 2025 Security Bulletin addressing eight high-severity vulnerabilities affecting multiple enterprise products in its Data Center and Server offerings.

The vulnerabilities, discovered through Atlassian’s Bug Bounty program, penetration testing processes, and third-party library scans, pose significant security risks including denial-of-service (DoS) attacks and privilege escalation.

All identified issues have been patched in the latest product versions released this month, with the bulletin information current as of May 20, 2025.

Five of the eight high-severity vulnerabilities involve denial-of-service weaknesses in third-party dependencies integrated within Atlassian’s product suite.

Both Bamboo and Confluence Data Center and Server installations are affected by a vulnerability (CVE-2025-31650) in the Apache Tomcat Coyote module, carrying a CVSS severity score of 7.5.

Confluence faces an additional DoS risk through a vulnerability in the XStream library (CVE-2024-47072), also rated 7.5 on the CVSS scale.

Fisheye/Crucible users should be aware of a separate DoS vulnerability (CVE-2024-57699) in the JSON Smart dependency.

Meanwhile, Jira Software and Jira Service Management platforms are exposed to potential service disruption through a high-severity vulnerability (CVE-2025-24970) discovered in the Netty Handler component.

These dependency-based vulnerabilities highlight the increasing security challenges posed by the software supply chain across enterprise applications.

Privilege Escalation Risk in Jira Products

Beyond the denial-of-service threats, the security bulletin reveals a particularly concerning privilege escalation vulnerability (CVE-2025-22157) affecting both Jira Core Data Center and Jira Service Management Data Center installations.

With a CVSS score of 7.2, this vulnerability could potentially allow attackers to gain unauthorized elevated permissions within affected systems.

The privilege escalation issue impacts multiple versions of both products, including the latest 10.x releases prior to the security patches.

Immediate Patching Strongly Recommended

Atlassian emphasizes that customers should immediately upgrade to the fixed versions detailed in the bulletin to mitigate these security risks.

For Bamboo, the recommended Data Center version is 10.2.4 (LTS), while Confluence users should update to version 9.2.4 (LTS).

Fisheye/Crucible installations should be upgraded to version 4.9.1, and Jira products to the respective Data Center versions 10.3.5 or 10.3.6 (LTS).

According to the Report, The company notes that these monthly security bulletins cover vulnerabilities with lower impact than those released as Critical Security Advisories, which are published outside the monthly schedule when necessary.

Organizations using Atlassian products in mission-critical environments should prioritize these updates as part of their regular security maintenance procedures.

Customers can access the Vulnerability Disclosure Portal to search for CVEs or check if their product versions are affected by known vulnerabilities.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!