First published: Wed Jun 29 2022(Updated: )
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Credit: security@atlassian.com
Affected Software | Affected Version | How to fix |
---|---|---|
Atlassian Jira Data Center | >=8.0.0<8.13.22 | |
Atlassian Jira Data Center | >=8.14.0<8.20.10 | |
Atlassian Jira Data Center | >=8.21.0<8.22.4 | |
Atlassian Jira Server | >=8.0.0<8.13.22 | |
Atlassian Jira Server | >=8.14.0<8.20.10 | |
Atlassian Jira Server | >=8.21.0<8.22.4 | |
Atlassian Jira Service Desk | >=4.0.0<4.13.22 | |
Atlassian Jira Service Desk | >=4.0.0<4.13.22 | |
Atlassian Jira Service Management | >=4.14.0<4.20.10 | |
Atlassian Jira Service Management | >=4.14.0<4.20.10 | |
Atlassian Jira Service Management | >=4.21.0<4.22.4 | |
Atlassian Jira Service Management | >=4.21.0<4.22.4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID of this issue is CVE-2022-26135.
The severity of CVE-2022-26135 is medium with a CVSS score of 6.5.
Atlassian Jira Server and Data Center versions 8.0.0 to 8.22.4, Atlassian Jira Service Desk versions 4.0.0 to 4.13.22, and Atlassian Jira Service Management versions 4.14.0 to 4.22.4 are affected by CVE-2022-26135.
A remote authenticated user can exploit CVE-2022-26135 by performing a full read server-side request forgery via a batch endpoint.
Yes, patches and fixes are available for CVE-2022-26135. It is recommended to update to the latest version of the affected Atlassian products.