CVE-2022-26135

Katalog CVE

CVSS 6.5 · Medium EPSS 71,6%

Kerentanan Server-Side Request Forgery (SSRF) pada atlassian jira data center, atlassian jira server +2 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

Rincian

Terbit di NVD

30 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

71,6% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022 mitigasi · advisory vendor
• https://jira.atlassian.com/browse/JRASERVER-73863 advisory vendor
• https://jira.atlassian.com/browse/JSDSERVER-11840 advisory vendor