Description (CNA)
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Atlassian / Jira Core Server | affected 8.0.0 before unspecified; affected unspecified before 8.13.22; affected 8.14.0 before unspecified; affected unspecified before 8.20.10; affected 8.21.0 before unspecified; affected unspecified before 8.22.4 |
| Atlassian / Jira Software Server | affected 8.0.0 before unspecified; affected unspecified before 8.13.22; affected 8.14.0 before unspecified; affected unspecified before 8.20.10; affected 8.21.0 before unspecified; affected unspecified before 8.22.4 |
| Atlassian / Jira Software Data Center | affected 8.0.0 before unspecified; affected unspecified before 8.13.22; affected 8.14.0 before unspecified; affected unspecified before 8.20.10; affected 8.21.0 before unspecified; affected unspecified before 8.22.4 |
| Atlassian / Jira Service Management Server | affected 4.0.0 before unspecified; affected unspecified before 4.13.22; affected 4.14.0 before unspecified; affected unspecified before 4.20.10; affected 4.21.0 before unspecified; affected unspecified before 4.22.4 |
| Atlassian / Jira Service Management Data Center | affected 4.0.0 before unspecified; affected unspecified before 4.13.22; affected 4.14.0 before unspecified; affected unspecified before 4.20.10; affected 4.21.0 before unspecified; affected unspecified before 4.22.4 |
CWE
No CWE identifiers supplied.
References
- https://jira.atlassian.com/browse/JRASERVER-73863
- https://jira.atlassian.com/browse/JSDSERVER-11840
- https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.