Vulnerability in Atlassian Jira Core Data Center
CVE-2025-22157
This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center…
EPSS: 0.006 (45.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Atlassian Jira Core Data Center — versions 10.5.0, 10.4.0 to 10.4.1, 10.3.0 to 10.3.4
- Atlassian Jira Core Server — versions 9.12.0 to 9.12.19, 9.12.22 to 9.12.23
- Atlassian Jira_data_center
- Atlassian Jira_server
- Atlassian Jira Service Management Data Center — versions 10.5.0, 10.4.0 to 10.4.1, 10.3.0 to 10.3.4
- Atlassian Jira Service Management Server — versions 5.12.0 to 5.12.19, 5.12.22 to 5.12.23
Weakness classification (CWE)
References
- security@atlassian.com (Vendor Advisory)
- security@atlassian.com (Patch, Vendor Advisory)
- security@atlassian.com (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-22157?
- CVE-2025-22157 is a high-severity vulnerability in Atlassian Jira Core Data Center, classified under Improper Access Control. CVSS score: 8.8/10. Published 2025-05-20.
- How severe is CVE-2025-22157?
- High severity. CVSS v3 base score is 8.8 out of 10.