CVE-2022-0540
First published: Wed Apr 20 2022(Updated: )
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Credit: security@atlassian.com security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Jira Data Center | <8.13.8 | |
| Atlassian Jira Data Center | >=8.14.0<8.20.6 | |
| Atlassian Jira Data Center | >=8.21.0<8.22.0 | |
| Atlassian Jira Server | <8.13.8 | |
| Atlassian Jira Server | >=8.14.0<8.20.6 | |
| Atlassian Jira Server | >=8.21.0<8.22.0 | |
| Atlassian Jira Service Management | <4.13.8 | |
| Atlassian Jira Service Management | <4.13.18 | |
| Atlassian Jira Service Management | >=4.14.0<4.20.6 | |
| Atlassian Jira Service Management | >=4.14.0<4.20.6 | |
| Atlassian Jira Service Management | >=4.21.0<4.22.0 | |
| Atlassian Jira Service Management | >=4.21.0<4.22.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-0540?
CVE-2022-0540 is a vulnerability in Jira Seraph that allows a remote unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request.
Which versions of Atlassian Jira Server and Data Center are affected by CVE-2022-0540?
CVE-2022-0540 affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0.
How severe is CVE-2022-0540?
CVE-2022-0540 has a severity score of 9.8, which is considered critical.
What is the official reference for CVE-2022-0540?
The official reference for CVE-2022-0540 can be found at the Atlassian Jira Security Advisory released on April 20, 2022.
How can I fix CVE-2022-0540?
To fix CVE-2022-0540, it is recommended to upgrade to Atlassian Jira Server or Data Center versions 8.13.18, 8.20.6, or 8.22.0, depending on the current version you are running.
- collector/nvd-index
- agent/type
- agent/author
- agent/softwarecombine
- agent/severity
- agent/references
- agent/remedy
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/tags
- vendor/atlassian
- canonical/atlassian jira data center
- version/atlassian jira data center/8.14.0
- version/atlassian jira data center/8.21.0
- canonical/atlassian jira server
- version/atlassian jira server/8.14.0
- version/atlassian jira server/8.21.0
- canonical/atlassian jira service management
- version/atlassian jira service management/4.14.0
- version/atlassian jira service management/4.21.0