weweave GmbH Marketplace Bug Bounty
By weweave GmbH Bug bounty on Bugcrowd weweave.net
- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 24
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays up to $1,500
- for critical bugs, from $100.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,500 |
| High |
|
$900 |
| Medium |
|
$300 |
| Low |
|
$100 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $1,500
Scope
24 assets you may test.
Web 24
- https://marketplace.atlassian.com/apps/1220302/data-tables-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1221789/youtube-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1221832/jsfiddle-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1221973/content-tools-for-confluence?hosting=cloud&tab=overview
- https://marketplace.atlassian.com/apps/1222532/prism-syntax-highlighter-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1222562/flowchart-processes-for-confluence?hosting=cloud&tab=overview
- https://marketplace.atlassian.com/apps/1222572/mermaid-charts-diagrams-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1222572/mermaid-charts-diagrams-for-confluence?tab=overview&hosting=datacenter
- https://marketplace.atlassian.com/apps/1222572/mermaid-charts-diagrams-for-confluence?tab=overview&hosting=server
- https://marketplace.atlassian.com/apps/1222612/chart-js-diagrams-for-confluence-cloud
- https://marketplace.atlassian.com/apps/1222737/jsbarcode-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1223493/custom-css-code-for-confluence?hosting=cloud&tab=overview
- https://marketplace.atlassian.com/apps/1223533/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1224009/content-mirror-for-confluence?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1224394/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1224537/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1225264/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1226668/dynamic-status-labels-for-confluence?hosting=cloud&tab=overview
- https://marketplace.atlassian.com/apps/1226741/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1227226/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1228296/rapidoc-openapi-swagger-specification-ui-for-confluence?hosting=cloud&tab=overview
- https://marketplace.atlassian.com/apps/1229317/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1235463/?tab=overview&hosting=cloud
- https://marketplace.atlassian.com/apps/1236260/?tab=overview&hosting=cloud
Rules
What the policy asks of you, and the bug types it won't reward, quoted from weweave GmbH Marketplace Bug Bounty (via Bugcrowd)'s policy.
While testing
-
Do not access, impact, destroy or otherwise negatively impact weweave or Atlassians customers, or customer data in any way.
-
Researchers should use the "bugbounty-test-<bugcrowd-name>.atlassian.net" namespace provided in the instructions below.
-
Please do not create additional instances outside of this namespace for testing.
-
No pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program.
-
The use of automated scanners is strictly prohibited
-
You must ensure that customer data is not affected in any way as a result of your testing.
-
Please ensure you're being non-destructive whilst testing and are only testing on instances that you own.
-
Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure.
-
Do NOT test the physical security of weweave offices, employees, equipment, etc.
-
Reports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats).
Not accepted
-
SSRF and Blind SSRF findings without proving exploitability
-
Descriptive error messages (e.g. Stack Traces, application or server errors)
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages
-
Fingerprinting / banner disclosure on common/public services
-
Disclosure of known public files or directories, (e.g. robots.txt)
-
Clickjacking and issues only exploitable through clickjacking
-
CSRF on forms that are available to anonymous users (e.g. the contact form)
-
CSRF attacks that require knowledge of the CSRF token (e.g. attacks involving a local machine)
-
Logout Cross-Site Request Forgery (logout CSRF)
-
Content Spoofing
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
-
Lack of Secure/HTTPOnly flags on non-sensitive Cookies
-
Lack of Security Speedbump when leaving the site
-
Weak Captcha / Captcha Bypass
-
Login or Forgot Password page brute force and account lockout not enforced
-
OPTIONS HTTP method enabled
-
Username / email enumeration
-
Missing HTTP security headers
-
HTTP/DNS cache poisoning
-
SSL/TLS Issues
-
Missing or incorrect SPF records of any kind
-
Missing or incorrect DMARC records of any kind
-
Source code disclosure vulnerabilities
-
Information disclosure of non-confidential information
-
The ability to upload/download viruses or malicious files to the platform
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 4 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://marketplace.atlassian.com/apps/1236260/?tab=overview&hosting=cloud
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledg | Critical 9.3 | 5 Oct 2026 |
| CVE-2026-21584 | This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information | High 7.6 | 18 Aug 2026 |
| CVE-2026-21575 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interact | High 8.0 | 21 Jul 2026 |
| CVE-2026-21577 | This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a h | High 7.1 | 21 Jul 2026 |
| CVE-2026-21579 | This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability. Atlassian recommends that Conflue | High 8.2 | 21 Jul 2026 |
| CVE-2026-21571 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands on the remote s | Critical 9.4 | 21 Apr 2026 |
| CVE-2026-21570 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system. Atlassian recommends that Bamboo Data Center customers upgrade to la | High 8.6 | 17 Mar 2026 |
| CVE-2026-21569 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated attacker to access local and remote content which has high impact to confidentiality, low impact to integrity, high impact to availability, and requires no user | High 7.9 | 28 Jan 2026 |
| CVE-2025-22172 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22173 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22174 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22175 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22176 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22177 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22178 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22168 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22169 | Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22170 | Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22171 | Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users. | Medium 5.3 | 22 Oct 2025 |
| CVE-2025-22167 | This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and Ser | High 8.7 | 22 Oct 2025 |
| CVE-2025-22166 | This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center cu | High 8.3 | 21 Oct 2025 |
| CVE-2025-35115 | Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30. | Critical 9.2 | 26 Aug 2025 |
| CVE-2025-35112 | Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31. | Medium 5.1 | 26 Aug 2025 |
| CVE-2025-35113 | Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31. | Medium 4.8 | 26 Aug 2025 |
| CVE-2025-35114 | Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30. | High 8.7 | 26 Aug 2025 |
| CVE-2025-22165 | This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassia | Medium 5.9 | 24 Jul 2025 |
| CVE-2025-22157 | This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. Atlassia | High 7.2 | 20 May 2025 |
| CVE-2019-15002 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account. | Medium 4.3 | 11 Feb 2025 |
| CVE-2024-21703 | This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to confidentiality, | Medium 6.4 | 27 Nov 2024 |
| CVE-2024-21697 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires | High 8.8 | 19 Nov 2024 |
| CVE-2024-21690 | This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. This Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML or | High 8.2 | 21 Aug 2024 |
| CVE-2024-21689 | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to av | High 8.0 | 20 Aug 2024 |
| CVE-2024-21684 | There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0 to 8.19.1 are affected by this vulnerability. It is patched in 8.9.13 and 8.19.2. This open redirect vulnerability, with a CVSS Score of 3.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, allows an unauthenticated attack | Medium 4.3 | 24 Jul 2024 |
| CVE-2024-21687 | This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server. This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get the application to display the contents of a local file, or execute a different files already stored locally on the server which has high i | High 8.1 | 16 Jul 2024 |
| CVE-2024-21686 | This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS Score of 7.3, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires user interaction. Atla | High 8.7 | 16 Jul 2024 |
| CVE-2024-21685 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability which has high impact to confidentiality, no impact to integrity, no impact to availabi | Medium 6.5 | 18 Jun 2024 |
| CVE-2024-21683 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassi | High 8.8 | 21 May 2024 |
| CVE-2024-21677 | This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Co | High 8.8 | 19 Mar 2024 |
| CVE-2024-21678 | This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center A | High 8.5 | 20 Feb 2024 |
| CVE-2024-21682 | This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed in | High 7.2 | 20 Feb 2024 |
| CVE-2023-22512 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a vulnerable host (Confluence instance) connected to a network, which has no i | High 7.5 | 16 Jan 2024 |
| CVE-2023-22514 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.8, and a CVSS Vector of: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H which allows an unauthenticated attacker to execute arbitrary code which has high impact to confidentiality, high i | High 7.8 | 16 Jan 2024 |
| CVE-2024-21672 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker to remotely expose assets in your environment susceptible to exploitation which has high impact to c | High 8.8 | 16 Jan 2024 |
| CVE-2024-21673 | This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to confidenti | High 8.8 | 16 Jan 2024 |
| CVE-2024-21674 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to confident | High 7.5 | 16 Jan 2024 |
| CVE-2023-22526 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recom | High 8.8 | 16 Jan 2024 |
| CVE-2023-22527 | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. H | Critical 9.8 | 16 Jan 2024 |
| CVE-2023-22522 | This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the ad | High 8.8 | 6 Dec 2023 |
| CVE-2023-22523 | This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent. | High 8.8 | 6 Dec 2023 |
| CVE-2023-22524 | Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code. | Critical 9.8 | 6 Dec 2023 |
| CVE-2023-22516 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and | High 8.8 | 21 Nov 2023 |
| CVE-2023-22521 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian | High 8.8 | 21 Nov 2023 |
| CVE-2023-22518 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but | Critical 9.8 | 31 Oct 2023 |
| CVE-2023-22515 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site i | Critical 9.8 | 4 Oct 2023 |
| CVE-2023-22513 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlass | High 8.8 | 19 Sep 2023 |
| CVE-2023-22506 | This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact | High 8.8 | 19 Jul 2023 |
| CVE-2023-22508 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user inter | High 8.8 | 18 Jul 2023 |
| CVE-2023-22505 | This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interac | High 8.8 | 18 Jul 2023 |
| CVE-2023-22504 | Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature. | Medium 6.5 | 25 May 2023 |
| CVE-2023-22503 | Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15, fro | Medium 5.3 | 1 May 2023 |
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
No technology is perfect and weweave believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our application. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
This bounty is part of the Atlassian Marketplace Bounty Program At weweave, we develop software that strives for making your work with Atlassian Confluence & Jira more comfortable. Get Started Do not access, impact, destroy or otherwise negatively impact weweave or Atlassians customers, or customer data in any way. Ensure you understand the targets, scopes, exclusions, and rules below. Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access* Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc.) Path/Directory Traversal Issues *Cross Instance Data Leakage/Access refers to unauthorized data access between instances. Rules, Exclusions, and Scopes Any domain/property of weweave not listed in the targets section is strictly out of scope (for more information please see the out of scope and exclusions sections below). Researchers should use the "bugbounty-test-.atlassian.net" namespace provided in the instructions below. Please do not create additional instances outside of this namespace for testing. Creating Your JIRA + Confluence Cloud Instance To access the instance and start your testing (after you've read and understood the scope and exclusions listed below, of course) you can follow the below steps: Navigate to the checkout page which can be found here . Click "Next". Complete the form, using the following format: bugbounty-test- Note that should be replaced with your own bugcrowd username. Click "Start now". Once your instance has been completed that's it - you can test away. Out-of-Scope Anything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. However, to help avoid grey areas, below are examples of what is considered out of scope. Blind XSS must not return any user data that you do not have access to (e.g. Screen shots, cookies that aren't owned by you, etc.); when testing for blind XSS, please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your webserver, etc.). When testing, please exercise caution if injecting on any form that may be publicly visible - such as forums, etc. Before injection, please make sure your payload can be removed from the site. If it cannot be easily removed, please check with support@bugcrowd before performing the testing. No pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program. DO NOT under any circumstance leverage a finding to identify further issues. Any weweave website (e.g. weweave.net ) is out of scope for this bounty unless it is directly accessible from one of the targets or any associated services attached to the instance. Customer cloud instances and data are explicitly out of scope. Any repository that you are not an owner of - do not impact weweave, or Atlassian customers in any way. Only the latest version of our products are eligible for a reward. Any internal or development services. The following finding types are specifically excluded from the bounty SSRF and Blind SSRF findings without proving exploitability The use of automated scanners is strictly prohibited (we have these tools too - don't even think about using them) Descriptive error messages (e.g. Stack Traces, application or server errors) HTTP 404 codes/pages or other HTTP non-200 codes/pages Fingerprinting / banner disclosure on common/public services Disclosure of known public files or directories, (e.g. robots.txt) Clickjacking and issues only exploitable through clickjacking CSRF on forms that are available to anonymous users (e.g. the contact form) CSRF attacks that require knowledge of the CSRF token (e.g. attacks involving a local machine) Logout Cross-Site Request Forgery (logout CSRF) Content Spoofing Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality Lack of Secure/HTTPOnly flags on non-sensitive Cookies Lack of Security Speedbump when leaving the site Weak Captcha / Captcha Bypass Login or Forgot Password page brute force and account lockout not enforced OPTIONS HTTP method enabled Username / email enumeration Missing HTTP security headers, e.g. Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP, Content-Security-Policy-Report-Only, Cache-Control and Pragma HTTP/DNS cache poisoning SSL/TLS Issues, e.g. SSL Attacks such as BEAST, BREACH, Renegotiation attack, SSL Forward secrecy not enabled and SSL weak/insecure cipher suites No Load testing (DoS/DDoS etc.) is allowed on the instance (includes application DoS as well as network DoS) Missing or incorrect SPF records of any kind Missing or incorrect DMARC records of any kind Source code disclosure vulnerabilities Information disclosure of non-confidential information (e. g. issue id, project id, commit hashes) The ability to upload/download viruses or malicious files to the platform Email bombing/Flooding/rate limiting Please also note: Self-XSS reports will not be accepted. Similarly, any XSS where local access is required (i.e. User-Agent Header injection) will not be accepted. The only exception will be if you can show a working off-path MiTM attack that will allow for the XSS to trigger. Vulnerabilities that are limited to unsupported browsers will not be accepted (i.e. "this exploit only works in IE6/IE7"). A list of supported browsers can be found here|https://confluence.atlassian.com/display/Cloud/Supported+browsers)]. Known vulnerabilities in used libraries will not be accepted, or the reports that an Atlassian product uses an outdated third party library (e.g. jQuery, Apache HttpComponents etc.) unless you can prove exploitability. Rules You must ensure that customer data is not affected in any way as a result of your testing. Please ensure you're being non-destructive whilst testing and are only testing on instances that you own. In addition to above, customer instances are not to be accessed in any way (i.e. no customer data is accessed, customer credentials are not to be used or "verified"). If you believe you have found sensitive customer data (e.g., login credentials, API keys etc.) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate if/that it works. Use of any automated tools/scanners is strictly prohibited and will lead to you being removed from the program (trust us, we have those tools too). Reports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats). Non-plain text reports (e.g. PDF, DOCX) will be asked to be resubmitted in plain text. Grants/awards are at the discretion of weweave and we withhold the right to grant, modify or deny grants. But we'll be fair about it. Tax implications of any payouts are the sole responsibility of the reporter. Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure. Do NOT test the physical security of weweave offices, employees, equipment, etc. This bounty follows Bugcrowd’s standard disclosure terms. Public Disclosure Before disclosing an issue publicly we require that you first request permission from us. weweave will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without weweave’s written consent will have any allocated bounty withdrawn and disqualified from the program. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our official channels before going any further.