A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jira_data_center | Atlassian | 8.0.0 (including) | 8.13.22 (excluding) |
| Jira_data_center | Atlassian | 8.14.0 (including) | 8.20.10 (excluding) |
| Jira_data_center | Atlassian | 8.21.0 (including) | 8.22.4 (excluding) |
| Jira_server | Atlassian | 8.0.0 (including) | 8.13.22 (excluding) |
| Jira_server | Atlassian | 8.14.0 (including) | 8.20.10 (excluding) |
| Jira_server | Atlassian | 8.21.0 (including) | 8.22.4 (excluding) |
| Jira_service_desk | Atlassian | 4.0.0 (including) | 4.13.22 (excluding) |
| Jira_service_management | Atlassian | 4.14.0 (including) | 4.20.10 (excluding) |
| Jira_service_management | Atlassian | 4.21.0 (including) | 4.22.4 (excluding) |
Related Attack Patterns
References
- https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022
- https://jira.atlassian.com/browse/JRASERVER-73863
- https://jira.atlassian.com/browse/JSDSERVER-11840
- https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022
- https://jira.atlassian.com/browse/JRASERVER-73863
- https://jira.atlassian.com/browse/JSDSERVER-11840