Skip to content
Fencer Vulns
high 8.8

CVE-2022-26137 json

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked…

published 2022-07-20 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30704

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Patch / fix

  • Atlassian Bamboo Server 8.0.9, 8.1.8, 8.2.4
  • Atlassian Bamboo Data Center 8.0.9, 8.1.8, 8.2.4
  • Atlassian Bitbucket Server 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Atlassian Bitbucket Data Center 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Atlassian Confluence Server 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Atlassian Confluence Data Center 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Atlassian Crowd Server 4.3.8, 4.4.2
  • Atlassian Crowd Data Center 4.3.8, 4.4.2
  • Atlassian Crucible 4.8.10
  • Atlassian Fisheye 4.8.10
  • Atlassian Jira Core Server 8.13.22, 8.20.10, 8.22.4
  • Atlassian Jira Software Server 8.13.22, 8.20.10, 8.22.4
  • Atlassian Jira Software Data Center 8.13.22, 8.20.10, 8.22.4
  • Atlassian Jira Service Management Server 4.13.22, 4.20.10, 4.22.4
  • Atlassian Jira Service Management Data Center 4.13.22, 4.20.10, 4.22.4
  • atlassian bamboo 7.2.10, 8.0.9, 8.1.8, 8.2.4
  • atlassian bitbucket 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • atlassian confluence_data_center 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • atlassian confluence_server 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • atlassian crowd 4.3.8, 4.4.2
  • atlassian jira_data_center 8.13.22, 8.20.10, 8.22.4
  • atlassian jira_server 8.13.22, 8.20.10, 8.22.4
  • atlassian jira_service_desk 4.13.22
  • atlassian jira_service_management 4.20.10, 4.22.4

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

2.41% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Atlassian Bamboo Server
  • Atlassian Bamboo Data Center
  • Atlassian Bitbucket Server
  • Atlassian Bitbucket Data Center
  • Atlassian Confluence Server
  • Atlassian Confluence Data Center
  • Atlassian Crowd Server
  • Atlassian Crowd Data Center
  • Atlassian Crucible
  • Atlassian Fisheye
  • Atlassian Jira Core Server
  • Atlassian Jira Software Server
  • Atlassian Jira Software Data Center
  • Atlassian Jira Service Management Server
  • Atlassian Jira Service Management Data Center
  • atlassian bamboo
  • atlassian bitbucket
  • atlassian confluence_data_center
  • atlassian confluence_server
  • atlassian crowd
  • atlassian jira_data_center
  • atlassian jira_server
  • atlassian jira_service_desk
  • atlassian jira_service_management

Classification

Weakness
  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-346 Origin Validation Error

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.