Strix
26.1K

CVE-2022-26136

CRITICALCVSS 9.8/10EPSS 4.24%

Last modified

CVE-2022-26136 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. EPSS estimates a 4.24% chance of exploitation in the next 30 days.

Description

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
4.24%

89.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AtlassianBamboo>= 7.2.0, < 7.2.10
AtlassianBamboo>= 8.0.0, < 8.0.9
AtlassianBamboo>= 8.1.0, < 8.1.8
AtlassianBamboo>= 8.2.0, < 8.2.4
AtlassianBitbucket< 7.6.16
AtlassianBitbucket>= 7.7.0, < 7.17.8
AtlassianBitbucket>= 7.18.0, < 7.19.5
AtlassianBitbucket>= 7.20.0, < 7.20.2
AtlassianBitbucket>= 7.21.0, < 7.21.2
AtlassianBitbucket8.0.0
AtlassianBitbucket8.1.0
AtlassianConfluence Data Center< 7.4.17
AtlassianConfluence Data Center>= 7.5.0, < 7.13.7
AtlassianConfluence Data Center>= 7.14.0, < 7.14.3
AtlassianConfluence Data Center>= 7.15.0, < 7.15.2
AtlassianConfluence Data Center>= 7.16.0, < 7.16.4
AtlassianConfluence Data Center>= 7.17.0, < 7.17.4
AtlassianConfluence Data Center7.18.0
AtlassianConfluence Server< 7.4.17
AtlassianConfluence Server>= 7.5.0, < 7.13.7
AtlassianConfluence Server>= 7.14.0, < 7.14.3
AtlassianConfluence Server>= 7.15.0, < 7.15.2
AtlassianConfluence Server>= 7.16.0, < 7.16.4
AtlassianConfluence Server>= 7.17.0, < 7.17.4
AtlassianConfluence Server7.18.0
AtlassianCrowd< 4.3.8
AtlassianCrowd>= 4.4.0, < 4.4.2
AtlassianCrowd5.0.0
AtlassianCrucible< 4.8.10
AtlassianFisheye< 4.8.10
AtlassianJira Data Center>= 8.13.0, < 8.13.22
AtlassianJira Data Center>= 8.14.0, < 8.20.10
AtlassianJira Data Center>= 8.21.0, < 8.22.4
AtlassianJira Server>= 8.13.0, < 8.13.22
AtlassianJira Server>= 8.14.0, < 8.20.10
AtlassianJira Server>= 8.21.0, < 8.22.4
AtlassianJira Service Desk< 4.13.22
AtlassianJira Service Management>= 4.14.0, < 4.20.10
AtlassianJira Service Management>= 4.21.0, < 4.22.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-26136?
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
How severe is CVE-2022-26136?
CVE-2022-26136 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 4.24% probability of exploitation in the next 30 days.
How do I fix CVE-2022-26136?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-26136?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST