CVE-2022-39960: Netic Group Export

Medium severity, CVSS 5.3. EPSS: 25.7% chance of exploitation in the next 30 days.

The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/ URI.

Affected products

• Netic Group Export: before 1.0.3 (fixed in 1.0.3)

Published 2022-09-17. Last modified 2026-06-17.