A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP reques
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.13.18, 8.20.6, 8.22.0, 4.13.18, 4.20.6, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub, 1 Nuclei template
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Atlassian Jira Core Server
fixed in 8.13.18; From 8.14.0; fixed in 8.20.6; From 8.21.0; fixed in 8.22.0
- Atlassian Jira Software Server
fixed in 8.13.18; From 8.14.0; fixed in 8.20.6; From 8.21.0; fixed in 8.22.0
- Atlassian Jira Software Data Center
fixed in 8.13.18; From 8.14.0; fixed in 8.20.6; From 8.21.0; fixed in 8.22.0
- Atlassian Jira Service Management Server
fixed in 4.13.18; From 4.14.0; fixed in 4.20.6; From 4.21.0; fixed in 4.22.0
- Atlassian Jira Service Management Data Center
fixed in 4.13.18; From 4.14.0; fixed in 4.20.6; From 4.21.0; fixed in 4.22.0