CVSS: 9.8EPSS: 14%CPEs: 12EXPL: 1CVE-2022-0540
https://notcve.org/view.php?id=CVE-2022-0540
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. Una vulnerabilidad en Jira Seraph permite a un atacante remoto no autenticado omitir la autenticación mediante el envío de una petición HTTP especialmente diseñada. Esto afecta a Atlassian Jira Server y Data Center versiones anteriores a 8.13.18, versiones 8.14.0 y posteriores anteriores a 8.20.6, y versiones 8.21.0 y posteriores anteriores a 8.22.0. • https://github.com/Pear1y/CVE-2022-0540-RCE https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 https://jira.atlassian.com/browse/JRASERVER-73650 https://jira.atlassian.com/browse/JSDSERVER-11224 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43944
https://notcve.org/view.php?id=CVE-2021-43944
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Este problema se presenta para documentar que ha sido implementado una mejora de seguridad en la forma en que Jira Server y Data Center usan las plantillas. Las versiones afectadas de Atlassian Jira Server y Data Center permitían a atacantes remotos con permisos de administrador del sistema ejecutar código arbitrario por medio de la inyección de plantillas que conllevaba a una Ejecución de Código Remota (RCE) en la funcionalidad Email Templates. • https://jira.atlassian.com/browse/JRASERVER-73072 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43945
https://notcve.org/view.php?id=CVE-2021-43945
Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos con permisos de administrador de hojas de ruta inyectar HTML o JavaScript arbitrarios por medio de una vulnerabilidad de tipo Cross-Site Scripting (SXSS) Almacenado en el endpoint /rest/jpo/1.0/hierarchyConfiguration. Las versiones afectadas son anteriores a versión 8.20.3. • https://jira.atlassian.com/browse/JRASERVER-73069 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43941
https://notcve.org/view.php?id=CVE-2021-43941
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos modificar varios recursos (incluyendo CsvFieldMappingsPage.jspa e ImporterValueMappingsPage.jspa) por medio de una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin jira-importers. Las versiones afectadas son anteriores a versión 8.13.15, y desde versión 8.14.0 hasta 8.20.3 • https://jira.atlassian.com/browse/JRASERVER-73073 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43953
https://notcve.org/view.php?id=CVE-2021-43953
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos no autentificados cambiar la configuración de la retención de hilos y la monitorización de la CPU a través de una vulnerabilidad de falsificación de solicitud de sitio cruzado (CSRF) en el punto final /secure/admin/ViewInstrumentation.jspa. Las versiones afectadas son anteriores a la versión 8.13.16, y desde la versión 8.14.0 hasta la 8.20.5 • https://jira.atlassian.com/browse/JRASERVER-73170 • CWE-352: Cross-Site Request Forgery (CSRF) •