by Kastro
Paper/Archive/CVE-2022-0540

CVE-2022-0540

Atlassian Jira Core Server — A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP req…

EPSS 88%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.8.998 × 2020.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

Affected

ProductAffectedFixed inSource
Jira Core Serverunspecified – < 8.13.188.13.18CNA
Jira Core Server8.14.0 – < unspecifiedunspecifiedCNA
Jira Core Serverunspecified – < 8.20.68.20.6CNA
Jira Core Server8.21.0 – < unspecifiedunspecifiedCNA
Jira Core Serverunspecified – < 8.22.08.22.0CNA
Jira Software Serverunspecified – < 8.13.188.13.18CNA
Jira Software Server8.14.0 – < unspecifiedunspecifiedCNA
Jira Software Serverunspecified – < 8.20.68.20.6CNA
Jira Software Server8.21.0 – < unspecifiedunspecifiedCNA
Jira Software Serverunspecified – < 8.22.08.22.0CNA
Jira Software Data Centerunspecified – < 8.13.188.13.18CNA
Jira Software Data Center8.14.0 – < unspecifiedunspecifiedCNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refconfluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20refjira.atlassian.com/browse/JRASERVER-73650refjira.atlassian.com/browse/JSDSERVER-11224