Strix
26.1K

CVE-2022-26137

HIGHCVSS 8.8/10EPSS 1.85%

Last modified

CVE-2022-26137 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. EPSS estimates a 1.85% chance of exploitation in the next 30 days.

Description

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
1.85%

76.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
AtlassianBamboo>= 7.2.0, < 7.2.10
AtlassianBamboo>= 8.0.0, < 8.0.9
AtlassianBamboo>= 8.1.0, < 8.1.8
AtlassianBamboo>= 8.2.0, < 8.2.4
AtlassianBitbucket< 7.6.16
AtlassianBitbucket>= 7.7.0, < 7.17.8
AtlassianBitbucket>= 7.18.0, < 7.19.5
AtlassianBitbucket>= 7.20.0, < 7.20.2
AtlassianBitbucket>= 7.21.0, < 7.21.2
AtlassianBitbucket8.0.0
AtlassianBitbucket8.1.0
AtlassianConfluence Data Center< 7.4.17
AtlassianConfluence Data Center>= 7.5.0, < 7.13.7
AtlassianConfluence Data Center>= 7.14.0, < 7.14.3
AtlassianConfluence Data Center>= 7.15.0, < 7.15.2
AtlassianConfluence Data Center>= 7.16.0, < 7.16.4
AtlassianConfluence Data Center>= 7.17.0, < 7.17.4
AtlassianConfluence Data Center7.18.0
AtlassianConfluence Server< 7.4.17
AtlassianConfluence Server>= 7.5.0, < 7.13.7
AtlassianConfluence Server>= 7.14.0, < 7.14.3
AtlassianConfluence Server>= 7.15.0, < 7.15.2
AtlassianConfluence Server>= 7.16.0, < 7.16.4
AtlassianConfluence Server>= 7.17.0, < 7.17.4
AtlassianConfluence Server7.18.0
AtlassianCrowd< 4.3.8
AtlassianCrowd>= 4.4.0, < 4.4.2
AtlassianCrowd5.0.0
AtlassianCrucible< 4.8.10
AtlassianFisheye< 4.8.10
AtlassianJira Data Center>= 8.13.0, < 8.13.22
AtlassianJira Data Center>= 8.14.0, < 8.20.10
AtlassianJira Data Center>= 8.21.0, < 8.22.4
AtlassianJira Server>= 8.13.0, < 8.13.22
AtlassianJira Server>= 8.14.0, < 8.20.10
AtlassianJira Server>= 8.21.0, < 8.22.4
AtlassianJira Service Desk< 4.13.22
AtlassianJira Service Management>= 4.14.0, < 4.20.10
AtlassianJira Service Management>= 4.21.0, < 4.22.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-26137?
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
How severe is CVE-2022-26137?
CVE-2022-26137 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.85% probability of exploitation in the next 30 days.
How do I fix CVE-2022-26137?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-26137?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST