CVE-2022-26137 — Incorrect Behavior Order: Validate Before Canonicalize in Atlassian Bamboo Data Center

CWE-180 — Incorrect Behavior Order: Validate Before CanonicalizeCWE-346 — Origin Validation Error3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 68.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
22
Atlassian Bamboo Data CenterAtlassian Bamboo ServerAtlassian Bitbucket Data Center+19 more
Timeline
PublishedJul 20
Latest updateJul 21

Description

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages26 packages

▶NVDatlassian/jira_service_management4.14.0 — 4.20.10+1
▶CVEListV5atlassian/jira_service_management_serverunspecified — 4.13.22+4
▶CVEListV5atlassian/jira_service_management_data_centerunspecified — 4.13.22+4
▶NVDatlassian/jira_server8.13.0 — 8.13.22+2

Patches

Patch: jira.atlassian.com ↗Patch: jira.atlassian.com ↗Patch: jira.atlassian.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fpj5-pcgc-34g7: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the ap↗2022-07-21
▶
CVEList
CVE-2022-26137: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the ap↗2022-07-20
▶
CVE-2022-26137 — Atlassian vulnerability | cvebase