Atlassian Jira Service Management vulnerabilities

16 CVEs affecting Atlassian Jira Service Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-21683, published 2024-05-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-21683, published 2024-05-21. High severity, CVSS 8.8. EPSS: 88.3% chance of exploitation in the next 30 days. This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of…
CVE-2022-0540, published 2022-04-20. Critical severity, CVSS 9.8. EPSS: 88.1% chance of exploitation in the next 30 days. A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center…
CVE-2022-26135, published 2022-06-30. Medium severity, CVSS 6.5. EPSS: 71.6% chance of exploitation in the next 30 days. A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request…
CVE-2020-36239, published 2021-07-29. Critical severity, CVSS 9.8. EPSS: 49.8% chance of exploitation in the next 30 days. Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from…
CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2023-22501, published 2023-02-01. Critical severity, CVSS 9.1. EPSS: 15.5% chance of exploitation in the next 30 days. An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management…
CVE-2022-26136, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by…
CVE-2021-39115, published 2021-09-01. High severity, CVSS 7.2. EPSS: 4.5% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands…
CVE-2022-26137, published 2022-07-20. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.…
CVE-2021-43948, published 2022-02-15. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in…

Latest

CVE-2022-36800, published 2022-08-03. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability…
CVE-2021-43959, published 2022-07-26. Medium severity, CVSS 5.7. EPSS: 0.7% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request…
CVE-2021-43943, published 2022-02-24. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)…