CVE-2022-36800

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Atlassian	Jira Service Management Server	>= unspecified, < 4.22.2
Atlassian	Jira Service Management Data Center	>= unspecified, < 4.22.2

References

https://jira.atlassian.com/browse/JSDSERVER-11900Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JSDSERVER-11900Issue Tracking, Vendor Advisory

Timeline

Published: Aug 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-368016.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref CVE-2022-368024.9The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access interna CVE-2022-368038.8The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissi CVE-2022-368048.8Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,CVE-2022-36816.5A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless netwo CVE-2022-36828.8A vulnerability exists in the SDM600 file permission validation. An attacker could exploit the vulnerability by gaining access to the syste CVE-2022-368295.5PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files with CVE-2022-36837.5A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vu CVE-2022-368305.5PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access file CVE-2022-368315.5Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Note CVE-2022-368323.3Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to acces CVE-2022-368337.8Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11