CVE-2022-0540
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| atlassian | jira_data_center | < 8.13.8 |
| atlassian | jira_data_center | >= 8.14.0, < 8.20.6 |
| atlassian | jira_data_center | >= 8.21.0, < 8.22.0 |
| atlassian | jira_server | < 8.13.8 |
| atlassian | jira_server | >= 8.14.0, < 8.20.6 |
| atlassian | jira_server | >= 8.21.0, < 8.22.0 |
| atlassian | jira_service_management | < 4.13.8 |
| atlassian | jira_service_management | < 4.13.18 |
| atlassian | jira_service_management | >= 4.14.0, < 4.20.6 |
| atlassian | jira_service_management | >= 4.14.0, < 4.20.6 |
| atlassian | jira_service_management | >= 4.21.0, < 4.22.0 |
| atlassian | jira_service_management | >= 4.21.0, < 4.22.0 |
Check a specific version with /api/v1/cve/match.
References
- https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20
- https://jira.atlassian.com/browse/JRASERVER-73650
- https://jira.atlassian.com/browse/JSDSERVER-11224
- https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20
- https://jira.atlassian.com/browse/JRASERVER-73650
- https://jira.atlassian.com/browse/JSDSERVER-11224
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-0540