جزئیات آسیب‌پذیری
CVE-2022-26135
Atlassian Jira Core ServerAtlassian Jira Service Management Data CenterAtlassian Jira Service Management ServerAtlassian Jira Software Data CenterAtlassian Jira Software Server
CVSS 3.1
6.5متوسط
شرح رسمی (انگلیسی)
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 6.5متوسط | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Atlassian | Jira Core Server | v < 8.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳- https://jira.atlassian.com/browse/JRASERVER-73863 x_refsource_MISC
- https://jira.atlassian.com/browse/JSDSERVER-11840 x_refsource_MISC
- https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022 x_refsource_MISC
کانال تلگرام کُلون @kolunsec_fa
تازه‌های KEV، خبرهای مهم و خلاصه‌ی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۱/۰۴/۰۹
- آخرین به‌روزرسانی
- ۱۴۰۳/۰۸/۰۸
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- atlassian
- اولویت کُلون
- ۴۵ · متوسط
پیش‌بینی بهره‌برداری (EPSS)
۷۱٫۶۱٪
احتمال بهره‌برداری در ۳۰ روز
۹۹٫۴٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-918Server-Side Request Forgery (SSRF)