• 9.9
    • Critical
    • CVE-2022-0540

       Updates

      2022/05/05 11:30 AM PDT

      • Updated the List of affected Atlassian Marketplace Apps section to note the following apps have non-vulnerable updates available:
        • Secure Code Warrior® for Jira
        • Simple Tasklists
        • Simple Team Pages for Jira
        • UiPath Test Manager for Jira
        • Xporter - Export issues from Jira

      2022/04/25 11:40 AM PDT

      • Updated the List of affected Atlassian Marketplace Apps section of the advisory to note the following app is no longer supported:
        • Feedback for Jira - Forms for website

      2022/04/22 12:30 PM PDT

      • Updated the List of affected Atlassian Marketplace Apps section of the advisory to note the following apps have non-vulnerable updates available:
        • VCAP - Video Capture for Jira Service Management
        • Who deleted my issues

      2022/04/21 11:50 AM PDT

      • Updated the List of affected Atlassian Marketplace Apps section of the advisory to note the following apps have non-vulnerable updates available:
        • Calendar for Jira
        • Dependent Select List
        • Smart Checklist for Jira. Pro

      Jira Server and Data Center vulnerable to an authentication bypass in its web authentication framework, Jira Seraph.

      Although the vulnerability is in the core of Jira, it affects first and third party apps that specify roles-required at the webwork1 action namespace level and do not specify it at an action level. For a specific action to be affected, the action will also need to not perform any other authentication or authorization checks.

      For more information on potentially affected apps, please refer to the Determining which apps are affected section in Atlassian's security advisory.

      A remote, unauthenticated attacker could exploit this by requesting a specially crafted URL to bypass authentication and authorization requirements in WebWork actions using an affected configuration.

      This vulnerability was discovered by Khoadha of Viettel Cyber Security.

       

      Affected versions:

      • version < 8.13.18
      • 8.14.0 ≤ version < 8.20.6
      • 8.21.0 ≤ version < 8.22.0

      Fixed versions:

      • 8.13.x >= 8.13.18
      • 8.20.x >= 8.20.6
      • All versions >= 8.22.0

      References

      Jira Security Advisory 2022-04-20

            [JRASERVER-73650] Authentication Bypass in Jira Seraph - CVE-2022-0540

                When it comes to different websites and online shops, it is very important to implement two-factor registration and other security systems to protect yourself from fraudsters. For corporate email, Beeble is a good solution. So, using the end-to-end encrypted emails, you can receive, save, send even the most important documents that require complete confidentiality.    

            Alexander Drache added a comment -     When it comes to different websites and online shops, it is very important to implement two-factor registration and other security systems to protect yourself from fraudsters. For corporate email, Beeble is a good solution. So, using the end-to-end encrypted emails , you can receive, save, send even the most important documents that require complete confidentiality.    

            Alex Janes added a comment -

            Is there anything in the audit logs of a datacenter instance that would tell us if we have been breached by this vulnerability?

            Alex Janes added a comment - Is there anything in the audit logs of a datacenter instance that would tell us if we have been breached by this vulnerability?

            how can i disable or upgrade the insight plugin (Insight - Asset Management is now part of Jira Service Management) without upgrade to current Jira version

            or is there an other workaround? if not i am pretty sure that Atlassian loses next company!

            WHY? our problem is as follow:

            first our license has recently expired (the original plan was to move to the Atlassian cloud)
            but now ...  due to what recently happened ...  the Longest Atlassian Outage of All Time ... our COO stopped the migration project!

            so we are not able to simple upgrade the Jira server instance!

             

             

             

             

            Michael Ziegler added a comment - how can i disable or upgrade the insight plugin (Insight - Asset Management is now part of Jira Service Management) without upgrade to current Jira version or is there an other workaround? if not i am pretty sure that Atlassian loses next company! WHY? our problem is as follow: first our license has recently expired (the original plan was to move to the Atlassian cloud) but now ...  due to what recently happened ...  the Longest Atlassian Outage of All Time ... our COO stopped the migration project! so we are not able to simple upgrade the Jira server instance!        

            @joseph Trevisan - I never received an official response to my question but for safety sake, I disabled the plugin in any case. 

            Warren Kent added a comment - @joseph Trevisan - I never received an official response to my question but for safety sake, I disabled the plugin in any case. 

            Joseph Trevisan added a comment - - edited

            @Warren Kent

            I was wondering this also, did you ever find a means of verifying whether disabling the plugin reduced the potential for exploit? 

            Joseph Trevisan added a comment - - edited @Warren Kent I was wondering this also, did you ever find a means of verifying whether disabling the plugin reduced the potential for exploit? 

            Moving to cloud is going to be costly and ultimately a waste of time Unless you like Atlassian deleting and purging all of your data and taking weeks to get back to you.

            Jeff Tillett added a comment - Moving to cloud is going to be costly and ultimately a waste of time Unless you like Atlassian deleting and purging all of your data and taking weeks to get back to you.

            based on the suggestions - if i disable our mobile app plugin, ( i dont use the insight plugin ) will this essentially mitigate the vulnerability? We plan on migrating to cloud during the course of this calendar year so upgrading now would be costly and ultimately a waste of time.

            Warren Kent added a comment - based on the suggestions - if i disable our mobile app plugin, ( i dont use the insight plugin ) will this essentially mitigate the vulnerability? We plan on migrating to cloud during the course of this calendar year so upgrading now would be costly and ultimately a waste of time.

            dbfbab030e95 we generally release advisories shortly after fixes are released, but this case was different. Since a lot of third party apps were affected, we spent extra time exploring other options for customers who are unable to quickly install a fix for Jira or JSM, and spent extra time to coordinate a response with affected app vendors.

            Brian Adeloye (Inactive) added a comment - dbfbab030e95 we generally release advisories shortly after fixes are released, but this case was different. Since a lot of third party apps were affected, we spent extra time exploring other options for customers who are unable to quickly install a fix for Jira or JSM, and spent extra time to coordinate a response with affected app vendors.

            Does this timeline seem a little strange?

            Daniel Garcia added a comment - Does this timeline seem a little strange? 2022-02-15 version 8.20.6 is released with the fix 2022-03-23 this issue is raised 2022-04-06 a reference to https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 is added to the description 2022-04-20 the advisory goes out

            David Yu added a comment -

            Can the assessment metric be clarified? Description says "unauthenticated attacker" but metrics table should say "Privileges Required: None", right?

            David Yu added a comment - Can the assessment metric be clarified? Description says "unauthenticated attacker" but metrics table should say "Privileges Required: None", right?

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              32 Start watching this issue

                Created:
                Updated:
                Resolved: