SSRF in Atlassian Jira Core Server
CVE-2022-26135
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.716 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.716 · newest: 0.716 · change: 0.000
Affected products
- Atlassian Jira Core Server — versions 8.0.0, unspecified, 8.14.0
- Atlassian Jira Data Center
- Atlassian Jira Server
- Atlassian Jira Service Desk
- Atlassian Jira Service Management
- Atlassian Jira Service Management Data Center — versions 4.0.0, unspecified, 4.14.0
- Atlassian Jira Service Management Server — versions 4.0.0, unspecified, 4.14.0
- Atlassian Jira Software Data Center — versions 8.0.0, unspecified, 8.14.0
- Atlassian Jira Software Server — versions 8.0.0, unspecified, 8.14.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- jira.atlassian.com/browse/JRASERVER-73863 (Vendor Advisory)
- jira.atlassian.com/browse/JSDSERVER-11840 (Vendor Advisory)
- confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2… (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-26135?
- CVE-2022-26135 is a medium-severity vulnerability in Atlassian Jira Core Server, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.5/10. Published 2022-06-30.
- How severe is CVE-2022-26135?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2022-26135 known to be exploited?
- 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.