CVE-2022-36802

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Atlassian	Jira Align	>= unspecified, < 10.109.2

References

https://jira.atlassian.com/browse/JIRAALIGN-4326Permissions Required, Vendor Advisory
https://jira.atlassian.com/browse/JIRAALIGN-4326Permissions Required, Vendor Advisory

Timeline

Published: Oct 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-368038.8The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissi CVE-2022-368048.8Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,CVE-2022-36816.5A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless netwo CVE-2022-36828.8A vulnerability exists in the SDM600 file permission validation. An attacker could exploit the vulnerability by gaining access to the syste CVE-2022-368295.5PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files with CVE-2022-36837.5A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vu CVE-2022-368305.5PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access file CVE-2022-368315.5Path traversal vulnerability in UriFileUtils of Samsung Notes prior to version 4.3.14.39 allows attacker to access some file as Samsung Note CVE-2022-368323.3Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allows attackers to acces CVE-2022-368337.8Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 CVE-2022-368345.0Exposure of Sensitive Information vulnerability in Game Launcher prior to version 6.0.07 allows local attacker to access app data with user CVE-2022-368353.3Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files.