CVE-2025-22157: atlassian jira data center +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-22157

CVSS 8.8 · High EPSS 0,69%

Kerentanan Improper Access Control pada atlassian jira data center, atlassian jira server. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. Atlassian recommends that Jira Core Data Center and Server and Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Core Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.20 Jira Service Management Data Center and Server 5.12: Upgrade to a release greater than or equal to 5.12.20 Jira Core Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Service Management Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Core Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0 Jira Service Management Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0 Jira Core Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1 Jira Service Management Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1 See the release notes. You can download the latest version of Jira Core Data Center and Jira Service Management Data Center from the download center. This vulnerability was reported via our Atlassian (Internal) program.

Rincian

Terbit di NVD: 20 Mei 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 0,69% peluang dieksploitasi; lebih tinggi dari 51,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
atlassian	jira data center	Versi 5.12.0 hingga sebelum 5.12.20
atlassian	jira data center	Versi 9.12.0 hingga sebelum 9.12.20
atlassian	jira data center	Versi 10.3.0 hingga sebelum 10.3.5
atlassian	jira data center	Versi 10.4.0 hingga sebelum 10.5.1
atlassian	jira server	Versi 9.12.0 hingga sebelum 9.12.20
atlassian	jira server	Versi 10.3.0 hingga sebelum 10.3.5
atlassian	jira server	Versi 10.4.0 hingga sebelum 10.5.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://confluence.atlassian.com/pages/viewpage.action?pageId=1561365992 advisory vendor
https://jira.atlassian.com/browse/JRASERVER-78766 patch · advisory vendor
https://jira.atlassian.com/browse/JSDSERVER-16206 patch · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.