CVE-2022-26135
At a glance Severity MEDIUM 6.5 EPSS EPSS 71.62 % · percentile 99 (2026-10-27) State PUBLISHED Published 2022-06-30 Updated 2024-10-29 Assigner atlassian NVD status Modified Description A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CISA-ADP CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.13.22cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.14.0 < 8.20.10cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.21.0 < 8.22.4cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.13.22cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.14.0 < 8.20.10cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.21.0 < 8.22.4cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* ≥ 4.0.0 < 4.13.22cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* ≥ 4.0.0 < 4.13.22cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* ≥ 4.14.0 < 4.20.10cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* ≥ 4.14.0 < 4.20.10cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* ≥ 4.21.0 < 4.22.4cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* ≥ 4.21.0 < 4.22.4Affected products Product Versions Atlassian · Jira Core Server affected 8.0.0 < unspecified ; affected unspecified < 8.13.22 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.10 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.4 Atlassian · Jira Software Server affected 8.0.0 < unspecified ; affected unspecified < 8.13.22 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.10 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.4 Atlassian · Jira Software Data Center affected 8.0.0 < unspecified ; affected unspecified < 8.13.22 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.10 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.4 Atlassian · Jira Service Management Server affected 4.0.0 < unspecified ; affected unspecified < 4.13.22 ; affected 4.14.0 < unspecified ; affected unspecified < 4.20.10 ; affected 4.21.0 < unspecified ; affected unspecified < 4.22.4 Atlassian · Jira Service Management Data Center affected 4.0.0 < unspecified ; affected unspecified < 4.13.22 ; affected 4.14.0 < unspecified ; affected unspecified < 4.20.10 ; affected 4.21.0 < unspecified ; affected unspecified < 4.22.4
References
Sources
