Atlassian Jira Service Desk vulnerabilities

12 CVEs affecting Atlassian Jira Service Desk, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-43959, published 2022-07-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-26135, published 2022-06-30. Medium severity, CVSS 6.5. EPSS: 71.6% chance of exploitation in the next 30 days. A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request…
CVE-2020-36239, published 2021-07-29. Critical severity, CVSS 9.8. EPSS: 49.8% chance of exploitation in the next 30 days. Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from…
CVE-2019-14994, published 2019-09-19. High severity, CVSS 7.5. EPSS: 5.9% chance of exploitation in the next 30 days. The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version…
CVE-2022-26136, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by…
CVE-2021-39115, published 2021-09-01. High severity, CVSS 7.2. EPSS: 4.5% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands…
CVE-2019-15004, published 2019-11-07. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from…
CVE-2022-26137, published 2022-07-20. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.…
CVE-2020-14166, published 2020-07-01. Medium severity, CVSS 4.8. EPSS: 1.9% chance of exploitation in the next 30 days. The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or…
CVE-2019-15003, published 2019-11-07. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from…
CVE-2015-8481, published 2016-01-08. Low severity, CVSS 3.1. EPSS: 1.3% chance of exploitation in the next 30 days. Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup…

Latest

CVE-2021-43959, published 2022-07-26. Medium severity, CVSS 5.7. EPSS: 0.7% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request…
CVE-2020-14180, published 2020-09-21. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an…