Vulnerability · Published Apr 20, 2022 · Assigned by atlassian
CVE-2022-0540
Critical 9.8
In plain English
A critical-severity improper authentication in Jira Core Server from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 88.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira Core Server | unspecified – before 8.13.188.14.0 – before unspecifiedunspecified – before 8.20.68.21.0 – before unspecifiedunspecified – before 8.22.0 |
| Atlassian | Jira Software Server | unspecified – before 8.13.188.14.0 – before unspecifiedunspecified – before 8.20.68.21.0 – before unspecifiedunspecified – before 8.22.0 |
| Atlassian | Jira Software Data Center | unspecified – before 8.13.188.14.0 – before unspecifiedunspecified – before 8.20.68.21.0 – before unspecifiedunspecified – before 8.22.0 |
| Atlassian | Jira Service Management Server | unspecified – before 4.13.184.14.0 – before unspecifiedunspecified – before 4.20.64.21.0 – before unspecifiedunspecified – before 4.22.0 |
| Atlassian | Jira Service Management Data Center | unspecified – before 4.13.184.14.0 – before unspecifiedunspecified – before 4.20.64.21.0 – before unspecifiedunspecified – before 4.22.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 x_refsource_MISC
- https://jira.atlassian.com/browse/JRASERVER-73650 x_refsource_MISC
- https://jira.atlassian.com/browse/JSDSERVER-11224 x_refsource_MISC