CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2022-0540

CVSS 9.8v3.1pub. 2022-04-20upd. 2024-11-21

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Atlassian Jira Data Center

    APP
    Atlassian
    < 8.13.88.14.0 – 8.20.6 (excl.)8.21.0 – 8.22.0 (excl.)

  • Atlassian Jira Server

    APP
    Atlassian
    < 8.13.88.14.0 – 8.20.6 (excl.)8.21.0 – 8.22.0 (excl.)

  • Atlassian Jira Service Management

    APP
    Atlassian
    < 4.13.8< 4.13.184.14.0 – 4.20.6 (excl.)4.21.0 – 4.22.0 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2019-11581CRITICAL9.8⚠ KEVPL ✓same product

RCE poprzez server-side template injection w Atlassian Jira Server i Data Center

CVE-2023-22501CRITICAL9.1PL ✓same product

Atlassian Jira Service Management — ominięcie uwierzytelnienia (Auth Bypass)

CVE-2022-26136CRITICAL9.8PL ✓same product

Atlassian — pominięcie Servlet Filters umożliwia auth bypass i XSS

CVE-2020-36239CRITICAL9.8PL ✓same product

Atlassian Jira Data Center — RCE przez brak uwierzytelnienia w Ehcache RMI

CVE-2019-13990CRITICAL9.8PL ✓same product

XXE w Terracotta Quartz Scheduler — atak przez opis zadania XML