CVE-2022-26135: SSRF
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2022-26135.
What is the severity of CVE-2022-26135?
The severity of CVE-2022-26135 is medium with a CVSS score of 6.5.
Which products are affected by CVE-2022-26135?
Atlassian Jira Server and Data Center versions 8.0.0 to 8.22.4, Atlassian Jira Service Desk versions 4.0.0 to 4.13.22, and Atlassian Jira Service Management versions 4.14.0 to 4.22.4 are affected by CVE-2022-26135.
How can a remote authenticated user exploit CVE-2022-26135?
A remote authenticated user can exploit CVE-2022-26135 by performing a full read server-side request forgery via a batch endpoint.
Are there any patches or fixes available for CVE-2022-26135?
Yes, patches and fixes are available for CVE-2022-26135. It is recommended to update to the latest version of the affected Atlassian products.