Vulnerability details
CVE-2022-0540
Atlassian Jira Core ServerAtlassian Jira Data CenterAtlassian Jira ServerAtlassian Jira Service Management Data CenterAtlassian Jira Service Management ServerAtlassian Jira Software Data Center
CVSS 3.1
9.8Critical
Official description
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Atlassian | Jira Core Server | v < 8.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Data Center | v < 8.13.18 | CISA ADP / Vulnrichment |
| Atlassian | Jira Data Center | 8.14.0 ≤ v < 8.20.6 | CISA ADP / Vulnrichment |
| Atlassian | Jira Data Center | 8.21.0 ≤ v < 8.22.0 | CISA ADP / Vulnrichment |
| Atlassian | Jira Server | v < 8.13.18 | CISA ADP / Vulnrichment |
| Atlassian | Jira Server | 8.14.0 ≤ v < 8.20.6 | CISA ADP / Vulnrichment |
| Atlassian | Jira Server | 8.21.0 ≤ v < 8.22.0 | CISA ADP / Vulnrichment |
| Atlassian | Jira Service Management Data Center | v < 4.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.20.6 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.22.0 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.13.18 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | jira_service_management | v < 4.13.18 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | v < 4.13.18 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.14.0 ≤ v < 4.20.6 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.14.0 ≤ v < 4.20.6 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.21.0 ≤ v < 4.22.0 | CISA ADP / Vulnrichment |
| Atlassian | jira_service_management | 4.21.0 ≤ v < 4.22.0 | CISA ADP / Vulnrichment |
References and advisories
3- https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 x_refsource_MISC
- https://jira.atlassian.com/browse/JRASERVER-73650 x_refsource_MISC
- https://jira.atlassian.com/browse/JSDSERVER-11224 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2022-04-20
- Last updated
- 2024-10-24
- State
- Published
- Assigner (CNA)
- atlassian
- Kolun priority
- 50 · Medium
Exploit prediction (EPSS)
88.05%
Probability of exploitation in 30 days
99.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-287Improper Authentication