CVE-2022-26137

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

References

Link	Resource
https://jira.atlassian.com/browse/CWD-5815	Issue Tracking Patch
https://jira.atlassian.com/browse/FE-7410	Issue Tracking Patch
https://jira.atlassian.com/browse/JRASERVER-73897	Issue Tracking Patch
https://jira.atlassian.com/browse/BAM-21795	Issue Tracking Patch
https://jira.atlassian.com/browse/JSDSERVER-11863	Issue Tracking Patch
https://jira.atlassian.com/browse/CONFSERVER-79476	Issue Tracking Patch
https://jira.atlassian.com/browse/CRUC-8541	Issue Tracking Patch
https://jira.atlassian.com/browse/BSERV-13370	Issue Tracking Patch

Configurations

Configuration 1

cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*

cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*

cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*

cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*

cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*

cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*

cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*

cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

History

24 Jan 2023, 16:19

Type	Values Removed	Values Added
CPE		cpe:2.3:a:predictapp_project:predictapp::::::::
References	~~(MISC) https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06 -~~	(MISC) https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06 - Patch, Third Party Advisory
References	~~(MISC) https://github.com/abhilash1985/PredictApp/pull/73 -~~	(MISC) https://github.com/abhilash1985/PredictApp/pull/73 - Patch, Third Party Advisory
References	~~(MISC) https://vuldb.com/?id.218387 -~~	(MISC) https://vuldb.com/?id.218387 - Third Party Advisory
References	~~(MISC) https://vuldb.com/?ctiid.218387 -~~	(MISC) https://vuldb.com/?ctiid.218387 - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Predictapp Project predictapp Predictapp Project

16 Jan 2023, 13:15

Type	Values Removed	Values Added
New CVE

8.8^/10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.8 /10