description: Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.
problem types: RCE (Remote Code Execution)
affected:
{
vendor: Atlassian
product: Companion for Mac
versions:
version: < 1.0.0, status: unaffected
version: >= 1.0.0, status: affected
version: >= 1.1.0, status: affected
version: >= 1.2.0, status: affected
version: >= 1.2.2, status: affected
version: >= 1.2.3, status: affected
version: >= 1.2.4, status: affected
version: >= 1.2.5, status: affected
version: >= 1.2.6, status: affected
version: >= 1.3.0, status: affected
version: >= 1.3.1, status: affected
version: >= 1.4.1, status: affected
version: >= 1.4.2, status: affected
version: >= 1.4.3, status: affected
version: >= 1.4.4, status: affected
version: >= 1.4.5, status: affected
version: >= 1.4.6, status: affected
version: >= 1.5.0, status: affected
version: >= 1.6.0, status: affected
version: >= 1.6.1, status: affected
version: >= 2.0.0, status: unaffected
version: >= 2.0.1, status: unaffected
}
metrics:
cvssV3_0: [
version: 3.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
baseScore: 9.6
baseSeverity: CRITICAL
]