CVE-2022-0540

CRITICAL 9.8CVE-2022-0540 · Published 20/04/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
jira data center atlassian	`≥ 8.14.0, < 8.20.6≥ 8.21.0, < 8.22.0< 8.13.8`	`8.20.68.22.08.13.8`
jira server atlassian	`≥ 8.14.0, < 8.20.6≥ 8.21.0, < 8.22.0< 8.13.8`	`8.20.68.22.08.13.8`
jira service management atlassian	`≥ 4.14.0, < 4.20.6≥ 4.21.0, < 4.22.0< 4.13.18< 4.13.8`	`4.20.64.22.04.13.184.13.8`

Description

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

References

confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 · Issue Tracking
jira.atlassian.com/browse/JRASERVER-73650 · Issue Tracking
jira.atlassian.com/browse/JSDSERVER-11224 · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free