Published: 20/04/2022 Updated: 08/08/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 606

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

A vulnerability in Jira Seraph allows a remote, unauthenticated malicious user to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions prior to 8.13.18, versions 8.14.0 and later prior to 8.20.6, and versions 8.21.0 and later prior to 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions prior to 4.13.18, versions 4.14.0 and later prior to 4.20.6, and versions 4.21.0 and later prior to 4.22.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
atlassian jira service management
atlassian jira data center
atlassian jira server

Check Point Reference: CPAI-2022-1985 Date Published: 11 Jan 2024 Severity: Critical ...

Atlassian Jira Seraph Authentication Bypass RCE（CVE-2022-0540）

Atlassian Jira Seraph Authentication Bypass RCE（CVE-2022-0540） English • 中文 Exploit Details As seen in author's blog, atlassian provided a long list of affected plugins (the vast majority of which were false positives), and the author listed several actual affected plugins According to the prompted conditions, combined with the Official documentation fo

pocsuite3 poc&exp

一些pocsuite3的脚本 shiro_key_brute 把ShiroAttack2的检测和爆破key逻辑抠出来。用于批量测试shiro key是否可爆破。使用步骤： 1把shiro_keystxt放入pocsuite3\data目录 2修改pocsuite3\lib\core\commonpy set_paths()函数中添加pathsSHIRO_KEYS = ospathjoin(pathsPOCSUITE_DATA_PATH, "shiro_keystxt") 22或者直接修改poc中g

NVD-CWE-noinfo https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 https://jira.atlassian.com/browse/JSDSERVER-11224 https://jira.atlassian.com/browse/JRASERVER-73650 https://nvd.nist.gov https://github.com/Pear1y/CVE-2022-0540-Preauth-RCE https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2022-1985.html

CVE-2022-0540

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect