CVSS: 9.8EPSS: 14%CPEs: 12EXPL: 1CVE-2022-0540
https://notcve.org/view.php?id=CVE-2022-0540
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. Una vulnerabilidad en Jira Seraph permite a un atacante remoto no autenticado omitir la autenticación mediante el envío de una petición HTTP especialmente diseñada. Esto afecta a Atlassian Jira Server y Data Center versiones anteriores a 8.13.18, versiones 8.14.0 y posteriores anteriores a 8.20.6, y versiones 8.21.0 y posteriores anteriores a 8.22.0. • https://github.com/Pear1y/CVE-2022-0540-RCE https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 https://jira.atlassian.com/browse/JRASERVER-73650 https://jira.atlassian.com/browse/JSDSERVER-11224 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43944
https://notcve.org/view.php?id=CVE-2021-43944
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Este problema se presenta para documentar que ha sido implementado una mejora de seguridad en la forma en que Jira Server y Data Center usan las plantillas. Las versiones afectadas de Atlassian Jira Server y Data Center permitían a atacantes remotos con permisos de administrador del sistema ejecutar código arbitrario por medio de la inyección de plantillas que conllevaba a una Ejecución de Código Remota (RCE) en la funcionalidad Email Templates. • https://jira.atlassian.com/browse/JRASERVER-73072 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43941
https://notcve.org/view.php?id=CVE-2021-43941
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos modificar varios recursos (incluyendo CsvFieldMappingsPage.jspa e ImporterValueMappingsPage.jspa) por medio de una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin jira-importers. Las versiones afectadas son anteriores a versión 8.13.15, y desde versión 8.14.0 hasta 8.20.3 • https://jira.atlassian.com/browse/JRASERVER-73073 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43952
https://notcve.org/view.php?id=CVE-2021-43952
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos no autenticados restaurar la configuración por defecto de los campos por medio de una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el endpoint /secure/admin/RestoreDefaults.jspa. Las versiones afectadas son anteriores a versión 8.21.0 • https://jira.atlassian.com/browse/JRASERVER-73138 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43946
https://notcve.org/view.php?id=CVE-2021-43946
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos autenticados añadir grupos de administradores para filtrar suscripciones a través de una vulnerabilidad de control de acceso rota en el endpoint /secure/EditSubscription.jspa. Las versiones afectadas son anteriores a la versión 8.13.21, y desde la versión 8.14.0 hasta la 8.20.9 • https://jira.atlassian.com/browse/JRASERVER-73071 •