According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.0.x prior to 8.13.22, 8.14.x prior to 8.20.10 or 8.21.x prior to 8.21.4. It is, therefore, affected by a vulnerability allowing a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Jira Service Management application running on the remote host is version 4.14.0 prior to version 4.20.10 or 4.21.0 prior to 4.22.4. It is, therefore, affected by multiple vulnerabilities:

- A flaw which permits authenticated remote attacker to perform a full read server-side request forgery via a batch endpoint (CVE-2022-26135).

- A vulnerability which permits a remote unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting (CVE-2022-26136).

- A vulnerability which permits a remote unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses & also invoke the Servlet Filter to respond tto CORS requests, resulting in a CORS bypass.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is version 4.14.0 prior to version 4.20.10 or 4.21.0 prior to 4.22.4. It is, therefore, affected by multiple vulnerabilities:

- A flaw which permits authenticated remote attacker to perform a full read server-side request forgery via a batch endpoint (CVE-2022-26135).

- A vulnerability which permits a remote unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting (CVE-2022-26136).

- A vulnerability which permits a remote unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses & also invoke the Servlet Filter to respond tto CORS requests, resulting in a CORS bypass.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira installed on the remote host is prior to 8.0.x < 8.13.22 / 8.20.x < 8.20.10 / 8.22.x < 8.22.4. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73863 advisory.

  - Full Read SSRF in Mobile Plugin CVE-2022-26135 (CVE-2022-26135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113269	Atlassian Jira 8.14.x < 8.20.10 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	7/8/2022	3/14/2023	medium
113886	Atlassian Jira Service Management 4.21.0 < 4.22.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	5/3/2023	5/3/2023	critical
113887	Atlassian Jira Service Desk < 4.13.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	5/3/2023	5/3/2023	critical
113268	Atlassian Jira 8.0.x < 8.13.22 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	7/8/2022	3/14/2023	medium
113270	Atlassian Jira 8.21.x < 8.22.4 Server-Side Request Forgery	Web App Scanning	Component Vulnerability	7/8/2022	3/14/2023	medium
113885	Atlassian Jira Service Management 4.14.0 < 4.20.10 / 4.21.0 < 4.22.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	5/3/2023	5/3/2023	critical
162737	Atlassian Jira 8.0.x < 8.13.22 / 8.20.x < 8.20.10 / 8.22.x < 8.22.4 (JRASERVER-73863)	Nessus	CGI abuses	7/6/2022	6/5/2024	medium

Detections

Analytics

Plugins Search

medium

critical

critical

medium

medium

critical

medium