CVE-2022-26135
Description
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
How to fix
- atlassian jira_data_center8.13.22, 8.20.10, 8.22.4 or later
- atlassian jira_server8.13.22, 8.20.10, 8.22.4 or later
- atlassian jira_service_desk4.13.22 or later
- atlassian jira_service_management4.20.10, 4.22.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira_data_center | 8.0.0 ≤ v < 8.13.22, 8.14.0 ≤ v < 8.20.10, 8.21.0 ≤ v < 8.22.4 | 8.13.22, 8.20.10, 8.22.4 |
| atlassian jira_server | 8.0.0 ≤ v < 8.13.22, 8.14.0 ≤ v < 8.20.10, 8.21.0 ≤ v < 8.22.4 | 8.13.22, 8.20.10, 8.22.4 |
| atlassian jira_service_desk | 4.0.0 ≤ v < 4.13.22 | 4.13.22 |
| atlassian jira_service_management | 4.14.0 ≤ v < 4.20.10, 4.21.0 ≤ v < 4.22.4 | 4.20.10, 4.22.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.