CVEvulnerability

CVE-2022-26135

6.5 MEDIUM Published 2022-06-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-06-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-918

Description

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

Affected configurations

• atlassian jira data center (>= 8.0.0 < 8.13.22) • atlassian jira data center (>= 8.14.0 < 8.20.10) • atlassian jira data center (>= 8.21.0 < 8.22.4) • atlassian jira server (>= 8.0.0 < 8.13.22) • atlassian jira server (>= 8.14.0 < 8.20.10) • atlassian jira server (>= 8.21.0 < 8.22.4) • atlassian jira service desk (>= 4.0.0 < 4.13.22) • atlassian jira service management (>= 4.14.0 < 4.20.10) • atlassian jira service management (>= 4.21.0 < 4.22.4)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References