CVE-2022-0540
At a glance Severity CRITICAL 9.8 EPSS EPSS 88.06 % · percentile 100 (2026-10-27) State PUBLISHED Published 2022-04-20 Updated 2024-10-24 Assigner atlassian NVD status Modified Description A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* < 8.13.8cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.14.0 < 8.20.6cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.21.0 < 8.22.0cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* < 8.13.8cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.14.0 < 8.20.6cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.21.0 < 8.22.0cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* < 4.13.8cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* < 4.13.18cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* ≥ 4.14.0 < 4.20.6cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* ≥ 4.14.0 < 4.20.6cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* ≥ 4.21.0 < 4.22.0cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* ≥ 4.21.0 < 4.22.0Affected products Product Versions Atlassian · Jira Core Server affected unspecified < 8.13.18 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.6 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.0 Atlassian · Jira Software Server affected unspecified < 8.13.18 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.6 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.0 Atlassian · Jira Software Data Center affected unspecified < 8.13.18 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.6 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.0 Atlassian · Jira Service Management Server affected unspecified < 4.13.18 ; affected 4.14.0 < unspecified ; affected unspecified < 4.20.6 ; affected 4.21.0 < unspecified ; affected unspecified < 4.22.0 Atlassian · Jira Service Management Data Center affected unspecified < 4.13.18 ; affected 4.14.0 < unspecified ; affected unspecified < 4.20.6 ; affected 4.21.0 < unspecified ; affected unspecified < 4.22.0
References
Sources
