CVE-2022-0540

CRITICAL severity · CVSS 9.8 · Improper authentication

9.8CVSS CRITICAL

Summary

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)93%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Atlassian Jira

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 ↗

CVE-2022-0540

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information