CVE-2022-0540
published 2022-04-20CVE-2022-0540: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
88.06%
99.8th percentile
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | jira_core_server | >= 8.14.0 < unspecified | unspecified |
| atlassian | jira_core_server | >= 8.21.0 < unspecified | unspecified |
| atlassian | jira_core_server | >= unspecified < 8.13.18 | 8.13.18 |
| atlassian | jira_core_server | >= unspecified < 8.20.6 | 8.20.6 |
| atlassian | jira_core_server | >= unspecified < 8.22.0 | 8.22.0 |
| atlassian | jira_data_center | < 8.13.8 | 8.13.8 |
| atlassian | jira_data_center | >= 8.14.0 < 8.20.6 | 8.20.6 |
| atlassian | jira_data_center | >= 8.21.0 < 8.22.0 | 8.22.0 |
| atlassian | jira_server | < 8.13.8 | 8.13.8 |
| atlassian | jira_server | >= 8.14.0 < 8.20.6 | 8.20.6 |
| atlassian | jira_server | >= 8.21.0 < 8.22.0 | 8.22.0 |
| atlassian | jira_service_management | < 4.13.8 | 4.13.8 |
| atlassian | jira_service_management | < 4.13.18 | 4.13.18 |
| atlassian | jira_service_management | >= 4.14.0 < 4.20.6 | 4.20.6 |
| atlassian | jira_service_management | >= 4.21.0 < 4.22.0 | 4.22.0 |
| atlassian | jira_service_management_data_center | >= 4.14.0 < unspecified | unspecified |
| atlassian | jira_service_management_data_center | >= 4.21.0 < unspecified | unspecified |
| atlassian | jira_service_management_data_center | >= unspecified < 4.13.18 | 4.13.18 |
| atlassian | jira_service_management_data_center | >= unspecified < 4.20.6 | 4.20.6 |
| atlassian | jira_service_management_data_center | >= unspecified < 4.22.0 | 4.22.0 |
| atlassian | jira_service_management_server | >= 4.14.0 < unspecified | unspecified |
| atlassian | jira_service_management_server | >= 4.21.0 < unspecified | unspecified |
| atlassian | jira_service_management_server | >= unspecified < 4.13.18 | 4.13.18 |
| atlassian | jira_service_management_server | >= unspecified < 4.20.6 | 4.20.6 |
| atlassian | jira_service_management_server | >= unspecified < 4.22.0 | 4.22.0 |
Detection & IOCsextracted from sources · hover to see the quote
url/InsightPluginShowGeneralConfiguration.jspa;
url/secure/WBSGanttManageScheduleJobAction.jspa;
- →Authentication bypass is triggered by appending a semicolon (;) to the end of a .jspa action URL path, bypassing Jira Seraph's authentication check. Look for GET requests to .jspa endpoints ending with a trailing semicolon.
- →A successful exploit returns HTTP 200 with the string 'General Insight Configuration' in the response body without authentication.
- →Two probe paths are used for detection: InsightPluginShowGeneralConfiguration.jspa; and secure/WBSGanttManageScheduleJobAction.jspa; — monitor for unauthenticated access returning 200 on either.
- ·Affected versions for Jira Server and Data Center: before 8.13.18, 8.14.0–8.20.5, and 8.21.0–8.21.x (before 8.22.0). Affected versions for Jira Service Management Server and Data Center: before 4.13.18, 4.14.0–4.20.5, and 4.21.0–4.21.x (before 4.22.0). Detection probes are only valid against these unpatched versions. ↗
- ·The nuclei template uses stop-at-first-match, meaning only one of the two probe URLs will be tested per scan run. Both paths should be tested independently for comprehensive coverage.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h5cm-vc68-69h9: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request
ghsa_unreviewed·2022-04-21
CVE-2022-0540 GHSA-h5cm-vc68-69h9: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
VulnCheck
Atlassian Jira Server and Data Center Authentication Bypass Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-0540 [CRITICAL] Atlassian Jira Server and Data Center Authentication Bypass Vulnerability
Atlassian Jira Server and Data Center Authentication Bypass Vulnerability
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Affected: Atlassian Jira Server and Data Center
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: ht
No detection rules found.
Nuclei
Atlassian Jira Seraph - Authentication Bypass
nuclei·CVSS 9.8
CVE-2022-0540 [CRITICAL] Atlassian Jira Seraph - Authentication Bypass
Atlassian Jira Seraph - Authentication Bypass
Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Template:
id: CVE-2022-0540
info:
name: Atlassian Jira Seraph - Authentication Bypass
author: DhiyaneshDK
severity: critical
description: |
Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects A
Checkpoint
25th April – Threat Intelligence Report
blogs_checkpoint·2022-04-25
CVE-2021-34473 25th April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 25th April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th April, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Russian state-sponsored APT actor Gamaredon (aka Shuckworm) has targeted Ukrainian organizations using at least four different variants of the Pterodo backdoor, likely to maintain persistence on infected computers. The group has been performing cyber-espionage campaigns in Ukraine since at least 2014.
Researchers have found
Recorded Future
Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
blogs_recorded_future·CVSS 9.6
[CRITICAL] Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
## Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
For years, software solutions built by Atlassian have found their way to nearly every organization's software stack. Tools such as JIRA, Confluence, Bamboo, and BitBucket are often seen playing a crucial role in various departments across enterprises.
From managing projects or handling organization-wide documentation, to hosting the very code of a product being developed by the organization, the constant reliance upon and amount of historical data held within these applications have turned them into a lucrative target for attackers, expanding the attack surface in the process.
## Historical Atlassian Vulnerabilities
Traditionally, vulnerabilities within the Atlassian software stack have originated from d
Recorded Future
Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
blogs_recorded_future·CVSS 9.6
[CRITICAL] Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
# Analyze Recent Atlassian Vulnerabilities and Keep Your Infrastructure Protected
For years, software solutions built by Atlassian have found their way to nearly every organization's software stack. Tools such as JIRA, Confluence, Bamboo, and BitBucket are often seen playing a crucial role in various departments across enterprises.
From managing projects or handling organization-wide documentation, to hosting the very code of a product being developed by the organization, the constant reliance upon and amount of historical data held within these applications have turned them into a lucrative target for attackers, expanding the attack surface in the process.
## Historical Atlassian Vulnerabilities
Traditionally, vulnerabilities within the Atlassian software stack have originated from di
https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20https://jira.atlassian.com/browse/JRASERVER-73650https://jira.atlassian.com/browse/JSDSERVER-11224https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20https://jira.atlassian.com/browse/JRASERVER-73650https://jira.atlassian.com/browse/JSDSERVER-11224
2022-04-20
Published
Exploited in the wild