CVE-2022-26135
En bref Sévérité MEDIUM 6.5 EPSS EPSS 71.62 % · centile 99 (2026-10-27) État PUBLISHED Publiée 2022-06-30 Mise à jour 2024-10-29 Attribuée par atlassian Statut NVD Modified Description A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CISA-ADP CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Configurations affectées (CPE NVD) cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.13.22cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.14.0 < 8.20.10cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* ≥ 8.21.0 < 8.22.4cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.13.22cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.14.0 < 8.20.10cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* ≥ 8.21.0 < 8.22.4cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* ≥ 4.0.0 < 4.13.22cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* ≥ 4.0.0 < 4.13.22cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* ≥ 4.14.0 < 4.20.10cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* ≥ 4.14.0 < 4.20.10cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* ≥ 4.21.0 < 4.22.4cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* ≥ 4.21.0 < 4.22.4Produits affectés Produit Versions Atlassian · Jira Core Server affected 8.0.0 < unspecified ; affected unspecified < 8.13.22 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.10 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.4 Atlassian · Jira Software Server affected 8.0.0 < unspecified ; affected unspecified < 8.13.22 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.10 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.4 Atlassian · Jira Software Data Center affected 8.0.0 < unspecified ; affected unspecified < 8.13.22 ; affected 8.14.0 < unspecified ; affected unspecified < 8.20.10 ; affected 8.21.0 < unspecified ; affected unspecified < 8.22.4 Atlassian · Jira Service Management Server affected 4.0.0 < unspecified ; affected unspecified < 4.13.22 ; affected 4.14.0 < unspecified ; affected unspecified < 4.20.10 ; affected 4.21.0 < unspecified ; affected unspecified < 4.22.4 Atlassian · Jira Service Management Data Center affected 4.0.0 < unspecified ; affected unspecified < 4.13.22 ; affected 4.14.0 < unspecified ; affected unspecified < 4.20.10 ; affected 4.21.0 < unspecified ; affected unspecified < 4.22.4
Références
Sources
