CVE-2022-26135

published 2022-06-30

CVE-2022-26135: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to…

Priority P3 58 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

Affected

39 ranges · showing 25

Vendor	Product	Version range	Fixed in
atlassian	jira_core_server	>= 8.0.0 < unspecified	unspecified
atlassian	jira_core_server	>= 8.14.0 < unspecified	unspecified
atlassian	jira_core_server	>= 8.21.0 < unspecified	unspecified
atlassian	jira_core_server	>= unspecified < 8.13.22	8.13.22
atlassian	jira_core_server	>= unspecified < 8.20.10	8.20.10
atlassian	jira_core_server	>= unspecified < 8.22.4	8.22.4
atlassian	jira_data_center	>= 8.0.0 < 8.13.22	8.13.22
atlassian	jira_data_center	>= 8.14.0 < 8.20.10	8.20.10
atlassian	jira_data_center	>= 8.21.0 < 8.22.4	8.22.4
atlassian	jira_server	>= 8.0.0 < 8.13.22	8.13.22
atlassian	jira_server	>= 8.14.0 < 8.20.10	8.20.10
atlassian	jira_server	>= 8.21.0 < 8.22.4	8.22.4
atlassian	jira_service_desk	>= 4.0.0 < 4.13.22	4.13.22
atlassian	jira_service_management	>= 4.14.0 < 4.20.10	4.20.10
atlassian	jira_service_management	>= 4.21.0 < 4.22.4	4.22.4
atlassian	jira_service_management_data_center	>= 4.0.0 < unspecified	unspecified
atlassian	jira_service_management_data_center	>= 4.14.0 < unspecified	unspecified
atlassian	jira_service_management_data_center	>= 4.21.0 < unspecified	unspecified
atlassian	jira_service_management_data_center	>= unspecified < 4.13.22	4.13.22
atlassian	jira_service_management_data_center	>= unspecified < 4.20.10	4.20.10
atlassian	jira_service_management_data_center	>= unspecified < 4.22.4	4.22.4
atlassian	jira_service_management_server	>= 4.0.0 < unspecified	unspecified
atlassian	jira_service_management_server	>= 4.14.0 < unspecified	unspecified
atlassian	jira_service_management_server	>= 4.21.0 < unspecified	unspecified
atlassian	jira_service_management_server	>= unspecified < 4.13.22	4.13.22

Detection & IOCs extracted from sources · hover to see the quote

url http://169.254.169.254/latest/meta-data/iam/security-credentials/↗

• → CVE-2022-26135 is a full-read SSRF via a batch endpoint in the Mobile Plugin for Jira; monitor for outbound HTTP requests from Jira processes to the AWS IMDS link-local address 169.254.169.254, which would indicate credential-harvesting exploitation. ↗
• → The SSRF is exploitable by any authenticated user, including self-registered accounts via the sign-up feature; alert on newly registered accounts making requests to the batch endpoint. ↗
• → IMDSv2 mitigates SSRF-based credential theft by requiring a PUT request with the X-aws-ec2-metadata-token-ttl-seconds header before a token-bearing GET; absence of this flow in IMDS traffic from Jira may indicate IMDSv1 exploitation. ↗

• · The SSRF affects Jira Server/Data Center across multiple version ranges; ensure version checks cover all three affected ranges before concluding a deployment is safe. ↗

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918