SSRF in Atlassian Jira Core Server
CVE-2022-26135
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.712 (99.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Atlassian Jira Core Server — versions 8.0.0, unspecified, 8.14.0
- Atlassian Jira_data_center
- Atlassian Jira_server
- Atlassian Jira_service_desk
- Atlassian Jira_service_management
- Atlassian Jira Service Management Data Center — versions 4.0.0, unspecified, 4.14.0
- Atlassian Jira Service Management Server — versions 4.0.0, unspecified, 4.14.0
- Atlassian Jira Software Data Center — versions 8.0.0, unspecified, 8.14.0
- Atlassian Jira Software Server — versions 8.0.0, unspecified, 8.14.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@atlassian.com (x_refsource_MISC, Vendor Advisory)
- security@atlassian.com (x_refsource_MISC, Vendor Advisory)
- security@atlassian.com (x_refsource_MISC, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-26135?
- CVE-2022-26135 is a medium-severity vulnerability in Atlassian Jira Core Server, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2022-06-30.
- How severe is CVE-2022-26135?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2022-26135 known to be exploited?
- 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.