CVE-2022-0540

CVSS 9.8 CRITICALEPSS 88.3%CWE-287

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Atlassian · Jira Core Server Atlassian · Jira Service Management Data Center Atlassian · Jira Service Management Server Atlassian · Jira Software Data Center Atlassian · Jira Software Server

PoCs públicas encontradas — 1

githubgithub.com/Pear1y/CVE-2022-0540-RCE★ 71

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 https://jira.atlassian.com/browse/JRASERVER-73650 https://jira.atlassian.com/browse/JSDSERVER-11224