جزئیات آسیب‌پذیری
CVE-2022-0540
Atlassian Jira Core ServerAtlassian Jira Data CenterAtlassian Jira ServerAtlassian Jira Service Management Data CenterAtlassian Jira Service Management ServerAtlassian Jira Software Data Center
CVSS 3.1
9.8بحرانی
شرح رسمی (انگلیسی)
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Atlassian | Jira Core Server | v < 8.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Data Center | v < 8.13.18 | CISA ADP / Vulnrichment |
| Atlassian | Jira Data Center | 8.14.0 ≤ v < 8.20.6 | CISA ADP / Vulnrichment |
| Atlassian | Jira Data Center | 8.21.0 ≤ v < 8.22.0 | CISA ADP / Vulnrichment |
| Atlassian | Jira Server | v < 8.13.18 | CISA ADP / Vulnrichment |
| Atlassian | Jira Server | 8.14.0 ≤ v < 8.20.6 | CISA ADP / Vulnrichment |
| Atlassian | Jira Server | 8.21.0 ≤ v < 8.22.0 | CISA ADP / Vulnrichment |
| Atlassian | Jira Service Management Data Center | v < 4.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | jira_service_management | v < 4.13.18 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | v < 4.13.18 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.14.0 ≤ v < 4.20.6 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.14.0 ≤ v < 4.20.6 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.21.0 ≤ v < 4.22.0 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.21.0 ≤ v < 4.22.0 | CISA ADP / Vulnrichment |
منابع و راهنماها
۳- https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 x_refsource_MISC
- https://jira.atlassian.com/browse/JRASERVER-73650 x_refsource_MISC
- https://jira.atlassian.com/browse/JSDSERVER-11224 x_refsource_MISC
کانال تلگرام کُلون @kolunsec_fa
تازه‌های KEV، خبرهای مهم و خلاصه‌ی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۱/۰۱/۳۱
- آخرین به‌روزرسانی
- ۱۴۰۳/۰۸/۰۳
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- atlassian
- اولویت کُلون
- ۵۰ · متوسط
پیش‌بینی بهره‌برداری (EPSS)
۸۸٫۰۵٪
احتمال بهره‌برداری در ۳۰ روز
۹۹٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-287Improper Authentication