Lucene search

[email protected]CVE-2022-26135

HistoryJun 30, 2022 - 6:15 a.m.

CVE-2022-26135

2022-06-3006:15:00

CWE-918

[email protected]

web.nvd.nist.gov

cve-2022-26135

vulnerability

mobile plugin

jira

data center

server

server-side request forgery

authentication

atlassian jira

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.033 Low

EPSS

Percentile

91.2%

JSON

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

CPENameOperatorVersion
atlassian:jira_service_managementatlassian jira service managementlt4.22.4
atlassian:jira_service_managementatlassian jira service managementlt4.20.10
atlassian:jira_data_centeratlassian jira data centerlt8.22.4
atlassian:jira_data_centeratlassian jira data centerlt8.20.10
atlassian:jira_data_centeratlassian jira data centerlt8.13.22
atlassian:jira_serveratlassian jira serverlt8.22.4
atlassian:jira_serveratlassian jira serverlt8.20.10
atlassian:jira_serveratlassian jira serverlt8.13.22
atlassian:jira_service_deskatlassian jira service desklt4.13.22

CPE	Name	Operator	Version
atlassian:jira_service_management	atlassian jira service management	lt	4.22.4
atlassian:jira_service_management	atlassian jira service management	lt	4.20.10
atlassian:jira_data_center	atlassian jira data center	lt	8.22.4
atlassian:jira_data_center	atlassian jira data center	lt	8.20.10
atlassian:jira_data_center	atlassian jira data center	lt	8.13.22
atlassian:jira_server	atlassian jira server	lt	8.22.4
atlassian:jira_server	atlassian jira server	lt	8.20.10
atlassian:jira_server	atlassian jira server	lt	8.13.22
atlassian:jira_service_desk	atlassian jira service desk	lt	4.13.22

References

confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022

jira.atlassian.com/browse/JRASERVER-73863

jira.atlassian.com/browse/JSDSERVER-11840

Social References

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.033 Low

EPSS

Percentile

91.2%

JSON

Related for CVE-2022-26135

checkpoint_advisories1 nessus4 atlassian3 prion1 githubexploit1