Lucene search

[email protected]CVE-2022-26137

HistoryJul 20, 2022 - 6:15 p.m.

CVE-2022-26137

2022-07-2018:15:08

CWE-180

CWE-346

[email protected]

web.nvd.nist.gov

atlassian

vulnerability

security

cors bypass

remote attacker

unauthenticated

servlet filters

nvd

cve-2022-26137

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.1%

JSON

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Affected configurations

NVD

Node

atlassianbambooRange7.2.0–7.2.10

atlassianbambooRange8.0.0–8.0.9

atlassianbambooRange8.1.0–8.1.8

atlassianbambooRange8.2.0–8.2.4

atlassianbitbucketRange<7.6.16

atlassianbitbucketRange7.7.0–7.17.8

atlassianbitbucketRange7.18.0–7.19.5

atlassianbitbucketRange7.20.0–7.20.2

atlassianbitbucketRange7.21.0–7.21.2

atlassianbitbucketMatch8.0.0

atlassianbitbucketMatch8.1.0

atlassianconfluence_data_centerRange<7.4.17

atlassianconfluence_data_centerRange7.5.0–7.13.7

atlassianconfluence_data_centerRange7.14.0–7.14.3

atlassianconfluence_data_centerRange7.15.0–7.15.2

atlassianconfluence_data_centerRange7.16.0–7.16.4

atlassianconfluence_data_centerRange7.17.0–7.17.4

atlassianconfluence_data_centerMatch7.18.0

atlassianconfluence_serverRange<7.4.17

atlassianconfluence_serverRange7.5.0–7.13.7

atlassianconfluence_serverRange7.14.0–7.14.3

atlassianconfluence_serverRange7.15.0–7.15.2

atlassianconfluence_serverRange7.16.0–7.16.4

atlassianconfluence_serverRange7.17.0–7.17.4

atlassianconfluence_serverMatch7.18.0

atlassiancrowdRange<4.3.8

atlassiancrowdRange4.4.0–4.4.2

atlassiancrowdMatch5.0.0

atlassiancrucibleRange<4.8.10

atlassianfisheyeRange<4.8.10

atlassianjira_data_centerRange8.13.0–8.13.22

atlassianjira_data_centerRange8.14.0–8.20.10

atlassianjira_data_centerRange8.21.0–8.22.4

atlassianjira_serverRange8.13.0–8.13.22

atlassianjira_serverRange8.14.0–8.20.10

atlassianjira_serverRange8.21.0–8.22.4

atlassianjira_service_deskRange<4.13.22data_center

atlassianjira_service_deskRange<4.13.22server

atlassianjira_service_managementRange4.14.0–4.20.10data_center

atlassianjira_service_managementRange4.14.0–4.20.10server

atlassianjira_service_managementRange4.21.0–4.22.4data_center

atlassianjira_service_managementRange4.21.0–4.22.4server

CPENameOperatorVersion
atlassian:bambooatlassian bamboolt7.2.10
atlassian:bambooatlassian bamboolt8.0.9
atlassian:bambooatlassian bamboolt8.1.8
atlassian:bambooatlassian bamboolt8.2.4
atlassian:bitbucketatlassian bitbucketlt7.6.16
atlassian:bitbucketatlassian bitbucketlt7.17.8
atlassian:bitbucketatlassian bitbucketlt7.19.5
atlassian:bitbucketatlassian bitbucketlt7.20.2
atlassian:bitbucketatlassian bitbucketlt7.21.2
atlassian:bitbucketatlassian bitbucketeq8.0.0

CPE	Name	Operator	Version
atlassian:bamboo	atlassian bamboo	lt	7.2.10
atlassian:bamboo	atlassian bamboo	lt	8.0.9
atlassian:bamboo	atlassian bamboo	lt	8.1.8
atlassian:bamboo	atlassian bamboo	lt	8.2.4
atlassian:bitbucket	atlassian bitbucket	lt	7.6.16
atlassian:bitbucket	atlassian bitbucket	lt	7.17.8
atlassian:bitbucket	atlassian bitbucket	lt	7.19.5
atlassian:bitbucket	atlassian bitbucket	lt	7.20.2
atlassian:bitbucket	atlassian bitbucket	lt	7.21.2
atlassian:bitbucket	atlassian bitbucket	eq	8.0.0

Rows per page:

1-10 of 391

CNA Affected

[
  {
    "product": "Bamboo Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.0.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.1.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.2.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.2.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Bamboo Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.0.9",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.1.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.2.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.2.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Bitbucket Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.6.16",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.16.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.17.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.18.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.19.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.20.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.20.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.21.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "8.0.0"
      },
      {
        "status": "affected",
        "version": "8.1.0"
      }
    ]
  },
  {
    "product": "Bitbucket Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.6.16",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.16.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.17.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.18.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.19.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.20.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.20.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.21.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "8.0.0"
      },
      {
        "status": "affected",
        "version": "8.1.0"
      }
    ]
  },
  {
    "product": "Confluence Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.4.17",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.13.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.14.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.15.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.15.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.16.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.16.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.17.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.17.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.18.0"
      }
    ]
  },
  {
    "product": "Confluence Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.4.17",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.13.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.14.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.15.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.15.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.16.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.16.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.17.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.17.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.18.0"
      }
    ]
  },
  {
    "product": "Crowd Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.3.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.0.0"
      }
    ]
  },
  {
    "product": "Crowd Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.3.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.0.0"
      }
    ]
  },
  {
    "product": "Crucible",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.8.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Fisheye",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.8.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Core Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.13.22",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.20.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.22.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Software Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.13.22",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.20.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.22.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Software Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "8.13.22",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.20.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "8.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "8.22.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Service Management Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.13.22",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.20.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.22.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Service Management Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.13.22",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.14.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.20.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.21.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.22.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]