CVE-2022-26135

 

Published at: - 30-06-2022 08:15

Last modified: - 04-08-2022 05:31

Total changes: - 4

Description

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://jira.atlassian.com/browse/JRASERVER-73863
• https://jira.atlassian.com/browse/JSDSERVER-11840
• https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022

 

Keywords

NVD

 

CVE-2022-26135

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures