Jira Align - Improper Authorization in MasterUserEdit API - CVE-2022-36803

XMLWordPrintable

    • 6.5
    • Medium
    • CVE-2022-36803

      The MasterUserEdit API in Atlassian Jira Align before version 10.109.2 allows an authenticated attacker with the People role permission can use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox.

      Affected versions:

      • version < 10.109.2

      Fixed versions:

      • 10.109.2

            Assignee:
            Unassigned
            Reporter:
            Security Metrics Bot
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: