← Back to browse · API

CVE-2022-26135

Severity
MEDIUM
CVSS
6.5
EPSS
0.71169
Risk score
50.91
CISA KEV
No
PoC
No
Published
2022-06-30
Modified
2024-10-29
First seen
2026-08-07
Aliases
EUVD-2022-30702, GHSA-WFHV-4QH5-C632
Products
Atlassian:Jira Core Server 8.0.0 <unspecified, Atlassian:Jira Core Server 8.14.0 <unspecified, Atlassian:Jira Core Server 8.21.0 <unspecified, Atlassian:Jira Core Server unspecified <8.13.22, Atlassian:Jira Core Server unspecified <8.20.10, Atlassian:Jira Core Server unspecified <8.22.4, Atlassian:Jira Service Management Data Center 4.0.0 <unspecified, Atlassian:Jira Service Management Data Center 4.14.0 <unspecified, Atlassian:Jira Service Management Data Center 4.21.0 <unspecified, Atlassian:Jira Service Management Data Center unspecified <4.13.22, Atlassian:Jira Service Management Data Center unspecified <4.20.10, Atlassian:Jira Service Management Data Center unspecified <4.22.4, Atlassian:Jira Service Management Server 4.0.0 <unspecified, Atlassian:Jira Service Management Server 4.14.0 <unspecified, Atlassian:Jira Service Management Server 4.21.0 <unspecified, Atlassian:Jira Service Management Server unspecified <4.13.22, Atlassian:Jira Service Management Server unspecified <4.20.10, Atlassian:Jira Service Management Server unspecified <4.22.4, Atlassian:Jira Software Data Center 8.0.0 <unspecified, Atlassian:Jira Software Data Center 8.14.0 <unspecified, Atlassian:Jira Software Data Center 8.21.0 <unspecified, Atlassian:Jira Software Data Center unspecified <8.13.22, Atlassian:Jira Software Data Center unspecified <8.20.10, Atlassian:Jira Software Data Center unspecified <8.22.4, Atlassian:Jira Software Server 8.0.0 <unspecified, Atlassian:Jira Software Server 8.14.0 <unspecified, Atlassian:Jira Software Server 8.21.0 <unspecified, Atlassian:Jira Software Server unspecified <8.13.22, Atlassian:Jira Software Server unspecified <8.20.10, Atlassian:Jira Software Server unspecified <8.22.4
Sources
euvd EUVD-2022-30702

Description

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

References