CVE-2022-26135 json
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the s…
published 2022-06-30 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30702
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 71.6%
- EPSS 71.6% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 0
- none known
Summary
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Patch / fix
- Atlassian Jira Core Server 8.13.22, 8.20.10, 8.22.4
- Atlassian Jira Software Server 8.13.22, 8.20.10, 8.22.4
- Atlassian Jira Software Data Center 8.13.22, 8.20.10, 8.22.4
- Atlassian Jira Service Management Server 4.13.22, 4.20.10, 4.22.4
- Atlassian Jira Service Management Data Center 4.13.22, 4.20.10, 4.22.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
71.62% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- Atlassian Jira Core Server
- Atlassian Jira Software Server
- Atlassian Jira Software Data Center
- Atlassian Jira Service Management Server
- Atlassian Jira Service Management Data Center
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
jira.atlassian.com
/browse/JRASERVER-73863
vendor-advisory
-
jira.atlassian.com
/browse/JSDSERVER-11840
vendor-advisory
-
confluence.atlassian.com
/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022
mitigation, vendor-advisory
Sources
- CVE List CVE-2022-26135
- NVD CVE-2022-26135
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.