Vulnerabilities in Atlassian Products · CIAD-2025-0052
CERT-In advisory CIAD-2025-0052 · 14 Dec 2025
Official title
CIAD-2025-0052 : Multiple Vulnerabilities in Atlassian Products
Official record
Open source pageSummary
Check the official recordWhat changed
CERT-In reports multiple vulnerabilities in Atlassian products that allow remote code execution, denial of service, and unauthorized data access. Affected systems include Bamboo, Bitbucket, Confluence, Crowd, Fisheye, Crucible, Jira, and Jira Service Management. These vulnerabilities enable attackers to perform XML external entity injection, prototype pollution, file inclusion, improper authorization, server-side request forgery, and improper input validation. IT administrators and security teams must apply the security updates provided in the official Atlassian security bulletin to mitigate these risks.
What you must do
- Apply the security updates specified in the Atlassian security bulletin.
Key dates
- Original Issue Date
- 14 Dec 2025
Who is affected
Document text
CERT-In Advisory CIAD-2025-0052 Multiple Vulnerabilities in Atlassian Products Original Issue Date: December 14, 2025 Severity Rating: High
Systems Affected Bamboo Data Center and Server Bitbucket Data Center and Server Confluence Data Center and Server Crowd Data Center and Server Fisheye/Crucible Jira Data Center and Server Jira Service Management Data Center and Server
Overview Multiple vulnerabilities have been reported in Atlassian Products which could allow an attacker to execute RCE (Remote Code Execution), perform XXE (XML External Entity Injection), Prototype Pollution, File Inclusion, Improper Authorization, SSRF (server-side request forgery) attack, Information Disclosure, Improper Input Validation and cause Denial of Service (DoS) condition on the targeted system.
Target Audience: IT administrators, enterprise security teams, developers, and end-user organizations using Atlassian Products.
Risk Assessment: High risk of Remote Code Execution (RCE), SSRF (Server-Side Request Forgery), DoS (Denial of Service).
Impact Assessment: Potential for unauthorized access to sensitive data or service disruption.
Description Multiple vulnerabilities have been reported in various Atlassian Products:
Solution Apply appropriate updates as mentioned in Atlassian security bulletin: https://confluence.atlassian.com/security/security-bulletin-december-11-2025-1689616574.html
References Atlassian https://confluence.atlassian.com/security/security-bulletin-december-11-2025-1689616574.html
CVE Name CVE-2025-66516 CVE-2025-52434 CVE-2024-7254 CVE-2022-37601 CVE-2024-29415 CVE-2024-12905 CVE-2022-37599 CVE-2022-37603 CVE-2025-52999 CVE-2025-55163 CVE-2025-41248 CVE-2025-48989 CVE-2020-36518 CVE-2021-46877 CVE-2022-42004 CVE-2024-13009 CVE-2025-59250 CVE-2021-39227 CVE-2025-54988 CVE-2016-1182 CVE-2016-1181 CVE-2025-27152 CVE-2025-48976 CVE-2024-21634 CVE-2022-3517 CVE-2025-58754 CVE-2023-49735 CVE-2022-45693 CVE-2020-8203
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 14 Dec 2025
- Document number
- CIAD-2025-0052
- Issuing division
- CERT-In
- Coverage area
- cybersecurity