Lucene search

Security-metrics-botJSDSERVER-11900

HistoryJul 27, 2022 - 1:53 a.m.

User without "Browse Users" permission can view groups - CVE-2022-36800

2022-07-2701:53:20

security-metrics-bot

jira.atlassian.com

atlassian

jira

cve-2022-36800

information disclosure

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

35.3%

JSON

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the “Browse Users” permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint.

The affected versions are before version 4.22.2.

Affected versions:

version < 4.22.2

Fixed versions:

4.22.2

Affected configurations

Vulners

Node

atlassianjira_service_managementRange≤4.22.1data_center

atlassianjira_service_managementRange<4.22.2data_center

VendorProductVersionCPE
atlassianjira_service_management*cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*

Vendor	Product	Version	CPE
atlassian	jira_service_management	*	cpe:2.3:a:atlassian:jira_service_management:::::data_center:::*

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

35.3%

JSON

Related for JSDSERVER-11900