Vulnerability details
CVE-2022-26135
Atlassian Jira Core ServerAtlassian Jira Service Management Data CenterAtlassian Jira Service Management ServerAtlassian Jira Software Data CenterAtlassian Jira Software Server
CVSS 3.1
6.5Medium
Official description
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 6.5Medium | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Atlassian | Jira Core Server | v < 8.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | v < 8.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Core Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | v < 4.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Data Center | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | v < 4.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Service Management Server | 4.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | v < 8.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Data Center | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.13.22 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.22.4 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | v < 8.20.10 | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.0.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.14.0 ≤ v | CVEProject cvelistV5 (CNA) |
| Atlassian | Jira Software Server | 8.21.0 ≤ v | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://jira.atlassian.com/browse/JRASERVER-73863 x_refsource_MISC
- https://jira.atlassian.com/browse/JSDSERVER-11840 x_refsource_MISC
- https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2022-06-30
- Last updated
- 2024-10-29
- State
- Published
- Assigner (CNA)
- atlassian
- Kolun priority
- 45 · Medium
Exploit prediction (EPSS)
71.61%
Probability of exploitation in 30 days
99.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side Request Forgery (SSRF)