{"containers": {"cna": {"affected": [{"product": "Jira Core Server", "vendor": "Atlassian", "versions": [{"lessThan": "8.13.18", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.14.0", "versionType": "custom"}, {"lessThan": "8.20.6", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.21.0", "versionType": "custom"}, {"lessThan": "8.22.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Jira Software Server", "vendor": "Atlassian", "versions": [{"lessThan": "8.13.18", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.14.0", "versionType": "custom"}, {"lessThan": "8.20.6", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.21.0", "versionType": "custom"}, {"lessThan": "8.22.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Jira Software Data Center", "vendor": "Atlassian", "versions": [{"lessThan": "8.13.18", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.14.0", "versionType": "custom"}, {"lessThan": "8.20.6", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "8.21.0", "versionType": "custom"}, {"lessThan": "8.22.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Jira Service Management Server", "vendor": "Atlassian", "versions": [{"lessThan": "4.13.18", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.14.0", "versionType": "custom"}, {"lessThan": "4.20.6", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.21.0", "versionType": "custom"}, {"lessThan": "4.22.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Jira Service Management Data Center", "vendor": "Atlassian", "versions": [{"lessThan": "4.13.18", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.14.0", "versionType": "custom"}, {"lessThan": "4.20.6", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.21.0", "versionType": "custom"}, {"lessThan": "4.22.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2022-04-20T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0."}], "problemTypes": [{"descriptions": [{"description": "Improper Authentication", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-20T18:30:17", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/JRASERVER-73650"}, {"tags": ["x_refsource_MISC"], "url": "https://jira.atlassian.com/browse/JSDSERVER-11224"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2022-04-20T00:00:00", "ID": "CVE-2022-0540", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jira Core Server", "version": {"version_data": [{"version_affected": "<", "version_value": "8.13.18"}, {"version_affected": ">=", "version_value": "8.14.0"}, {"version_affected": "<", "version_value": "8.20.6"}, {"version_affected": ">=", "version_value": "8.21.0"}, {"version_affected": "<", "version_value": "8.22.0"}]}}, {"product_name": "Jira Software Server", "version": {"version_data": [{"version_affected": "<", "version_value": "8.13.18"}, {"version_affected": ">=", "version_value": "8.14.0"}, {"version_affected": "<", "version_value": "8.20.6"}, {"version_affected": ">=", "version_value": "8.21.0"}, {"version_affected": "<", "version_value": "8.22.0"}]}}, {"product_name": "Jira Software Data Center", "version": {"version_data": [{"version_affected": "<", "version_value": "8.13.18"}, {"version_affected": ">=", "version_value": "8.14.0"}, {"version_affected": "<", "version_value": "8.20.6"}, {"version_affected": ">=", "version_value": "8.21.0"}, {"version_affected": "<", "version_value": "8.22.0"}]}}, {"product_name": "Jira Service Management Server", "version": {"version_data": [{"version_affected": "<", "version_value": "4.13.18"}, {"version_affected": ">=", "version_value": "4.14.0"}, {"version_affected": "<", "version_value": "4.20.6"}, {"version_affected": ">=", "version_value": "4.21.0"}, {"version_affected": "<", "version_value": "4.22.0"}]}}, {"product_name": "Jira Service Management Data Center", "version": {"version_data": [{"version_affected": "<", "version_value": "4.13.18"}, {"version_affected": ">=", "version_value": "4.14.0"}, {"version_affected": "<", "version_value": "4.20.6"}, {"version_affected": ">=", "version_value": "4.21.0"}, {"version_affected": "<", "version_value": "4.22.0"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Authentication"}]}]}, "references": {"reference_data": [{"name": "https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20", "refsource": "MISC", "url": "https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20"}, {"name": "https://jira.atlassian.com/browse/JRASERVER-73650", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/JRASERVER-73650"}, {"name": "https://jira.atlassian.com/browse/JSDSERVER-11224", "refsource": "MISC", "url": "https://jira.atlassian.com/browse/JSDSERVER-11224"}]}}}}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2022-0540", "datePublished": "2022-04-20T00:00:00", "dateReserved": "2022-02-08T00:00:00", "dateUpdated": "2022-04-20T18:30:17", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "E697C406-32A4-47B8-A5D7-5368EA7A871C", "versionEndExcluding": "8.13.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FCC4AF6-596D-4476-AEF3-23217B060A25", "versionEndExcluding": "8.20.6", "versionStartIncluding": "8.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FB66C54-EF31-4E7C-8E17-32A108FEC911", "versionEndExcluding": "8.22.0", "versionStartIncluding": "8.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEDC4C09-8764-41F0-8757-FDED8C8FA0EF", "versionEndExcluding": "8.13.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "56F298E4-0956-4560-880D-47BA97D1D2EA", "versionEndExcluding": "8.20.6", "versionStartIncluding": "8.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4016C4DC-25F7-4F15-84CF-19547F5B9720", "versionEndExcluding": "8.22.0", "versionStartIncluding": "8.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", "matchCriteriaId": "135F2D8C-19FD-4A8C-A3C1-6A940EEED5BE", "versionEndExcluding": "4.13.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", "matchCriteriaId": "F5D099EC-2EC5-4A83-85F4-F61371821CC5", "versionEndExcluding": "4.13.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", "matchCriteriaId": "97EB58EA-E57A-4AFE-8627-F772A252A60B", "versionEndExcluding": "4.20.6", "versionStartIncluding": "4.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", "matchCriteriaId": "ED2F696D-6C18-418F-BFB8-721BD3762653", "versionEndExcluding": "4.20.6", "versionStartIncluding": "4.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*", "matchCriteriaId": "E75D38BE-2949-444B-A203-D136F48D1DBA", "versionEndExcluding": "4.22.0", "versionStartIncluding": "4.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*", "matchCriteriaId": "24A229DD-9707-42E8-97A7-91EE23970DE4", "versionEndExcluding": "4.22.0", "versionStartIncluding": "4.21.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0."}, {"lang": "es", "value": "Una vulnerabilidad en Jira Seraph permite a un atacante remoto no autenticado omitir la autenticaci\u00f3n mediante el env\u00edo de una petici\u00f3n HTTP especialmente dise\u00f1ada. Esto afecta a Atlassian Jira Server y Data Center versiones anteriores a 8.13.18, versiones 8.14.0 y posteriores anteriores a 8.20.6, y versiones 8.21.0 y posteriores anteriores a 8.22.0. Esto tambi\u00e9n afecta a Atlassian Jira Service Management Server y Data Center versiones anteriores a 4.13.18, versiones 4.14.0 y posteriores anteriores a 4.20.6, y versiones 4.21.0 y posteriores anteriores a 4.22.0"}], "id": "CVE-2022-0540", "lastModified": "2023-08-08T14:22:24.967", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-20T19:15:07.680", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JRASERVER-73650"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JSDSERVER-11224"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}