CVE-2022-0540

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
AtlassianJira Core Server>= unspecified, < 8.13.18; >= 8.14.0, < unspecified; >= unspecified, < 8.20.6; >= 8.21.0, < unspecified; >= unspecified, < 8.22.0
AtlassianJira Software Server>= unspecified, < 8.13.18; >= 8.14.0, < unspecified; >= unspecified, < 8.20.6; >= 8.21.0, < unspecified; >= unspecified, < 8.22.0
AtlassianJira Software Data Center>= unspecified, < 8.13.18; >= 8.14.0, < unspecified; >= unspecified, < 8.20.6; >= 8.21.0, < unspecified; >= unspecified, < 8.22.0
AtlassianJira Service Management Server>= unspecified, < 4.13.18; >= 4.14.0, < unspecified; >= unspecified, < 4.20.6; >= 4.21.0, < unspecified; >= unspecified, < 4.22.0
AtlassianJira Service Management Data Center>= unspecified, < 4.13.18; >= 4.14.0, < unspecified; >= unspecified, < 4.20.6; >= 4.21.0, < unspecified; >= unspecified, < 4.22.0
atlassianjira_data_center< 8.13.18; >= 8.14.0, < 8.20.6; >= 8.21.0, < 8.22.0
atlassianjira_server< 8.13.18; >= 8.14.0, < 8.20.6; >= 8.21.0, < 8.22.0
atlassianjira_service_management< 4.13.18; >= 4.14.0, < 4.20.6; >= 4.21.0, < 4.22.0
atlassianjira_service_management< 4.13.18; >= 4.14.0, < 4.20.6; >= 4.21.0, < 4.22.0

References

Timeline

Published
Apr 20, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-05419.8The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate CVE-2022-05426.1Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.CVE-2022-054310.0It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escapeCVE-2022-05445.5An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data usingCVE-2022-05457.8An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability,CVE-2022-05467.8A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause CVE-2022-05479.8OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes uCVE-2022-05496.5An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versioCVE-2022-05507.2Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker wCVE-2022-05517.2Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admCVE-2022-05525.9A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rCVE-2022-05534.6There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted fir
CVE-2022-0540: Critical severity, CVSS 9.8 | Vulnix