Vulnerability Intelligence Report
CVE-2022-26135
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
No Active Exploit Signals
CVSS Base Score
6.5
MEDIUM
Exploitability:2.9
Impact Score:3.6
EPSS Probability:71.17%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-918 ↗CWE-918 Server-Side Request Forgery (SSRF)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Atlassian | Jira Core Server | 8.0.0 < unspecified (affected), unspecified < 8.13.22 (affected), 8.14.0 < unspecified (affected), unspecified < 8.20.10 (affected), 8.21.0 < unspecified (affected), unspecified < 8.22.4 (affected) |
| Atlassian | Jira Software Server | 8.0.0 < unspecified (affected), unspecified < 8.13.22 (affected), 8.14.0 < unspecified (affected), unspecified < 8.20.10 (affected), 8.21.0 < unspecified (affected), unspecified < 8.22.4 (affected) |
| Atlassian | Jira Software Data Center | 8.0.0 < unspecified (affected), unspecified < 8.13.22 (affected), 8.14.0 < unspecified (affected), unspecified < 8.20.10 (affected), 8.21.0 < unspecified (affected), unspecified < 8.22.4 (affected) |
| Atlassian | Jira Service Management Server | 4.0.0 < unspecified (affected), unspecified < 4.13.22 (affected), 4.14.0 < unspecified (affected), unspecified < 4.20.10 (affected), 4.21.0 < unspecified (affected), unspecified < 4.22.4 (affected) |
| Atlassian | Jira Service Management Data Center | 4.0.0 < unspecified (affected), unspecified < 4.13.22 (affected), 4.14.0 < unspecified (affected), unspecified < 4.20.10 (affected), 4.21.0 < unspecified (affected), unspecified < 4.22.4 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
71.169%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Atlassian · Vendor · Australia |
| Reserved | 2022-02-25T00:00:00 |
| Published | 2022-06-30T05:20:15 |
| Patch Date | 2022-06-29 |
| Last Updated | 2024-10-29T15:20:52 |
Community Chatter & Buzz