CVE-2022-26135

MEDIUM

Atlassian Jira <8.13.22, <8.20.10, <8.22.4 - SSRF

Title source: llm

Description

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.

Exploits (2)

nomisec WORKING POC 88 stars
by assetnote · poc
https://github.com/assetnote/jira-mobile-ssrf-exploit
nomisec WORKING POC 11 stars
by safe3s · poc
https://github.com/safe3s/CVE-2022-26135

References (3)

Scores

CVSS v3 6.5
EPSS 0.8929
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-918
Status published
Products (4)
atlassian/jira_data_center 8.0.0 - 8.13.22
atlassian/jira_server 8.0.0 - 8.13.22
atlassian/jira_service_desk 4.0.0 - 4.13.22 (2 CPE variants)
atlassian/jira_service_management 4.14.0 - 4.20.10 (2 CPE variants)
Published Jun 30, 2022
Tracked Since Feb 18, 2026