CVE-2022-26137

HIGH

8.8

CVSS Score

Published: July 20, 2022 at 05:25 PM UTC

Updated: June 17, 2026 at 04:34 AM UTC

15 products affected across 1 vendorJira ServerJira Data CenterCrucible

Using Bamboo Server by Atlassian?

Get instant alerts when new vulnerabilities affect Bamboo Server - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Bamboo · Atlassianatlassian-app

95%

7.2.0 ≤ v < 7.2.108.0.0 ≤ v < 8.0.98.1.0 ≤ v < 8.1.88.2.0 ≤ v < 8.2.47.2.0 8.0.0 8.1.0 8.2.0

Affected range stops below 7.2.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.0.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.1.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.2.4, so it looks safe — our inference, not a vendor statement

Bitbucket · Atlassianatlassian-app

95%

v < 7.6.167.18.0 ≤ v < 7.19.57.20.0 ≤ v < 7.20.27.20.1 ≤ v < 7.20.27.21.0 ≤ v < 7.21.27.7.0 ≤ v < 7.17.87.18.0 7.20.1 7.21.0 7.7.0 8.0.0 8.1.0

Affected range stops below 7.17.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.19.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.20.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.21.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.6.16, so it looks safe — our inference, not a vendor statement

Confluence Data Center · Atlassianatlassian-app

95%

v ≥ 7.14.0v ≥ 7.15.0v ≥ 7.16.0v ≥ 7.17.0v ≥ 7.5.0v < 7.13.7v < 7.14.3v < 7.15.2v < 7.16.4v < 7.17.4v < 7.4.177.14.0 ≤ v < 7.14.37.15.0 ≤ v < 7.15.27.16.0 ≤ v < 7.16.47.17.0 ≤ v < 7.17.47.5.0 ≤ v < 7.13.77.14.0 7.15.0 7.16.0 7.17.0 7.18.0 7.5.0

Affected range stops below 7.13.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.14.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.15.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.16.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.17.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.4.17, so it looks safe — our inference, not a vendor statement

Confluence Server · Atlassianatlassian-app

95%

Affected range stops below 7.13.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.14.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.15.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.16.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.17.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.4.17, so it looks safe — our inference, not a vendor statement

Crowd · Atlassianatlassian-app

95%

v ≥ 4.4.0v < 4.3.8v < 4.4.24.4.0 ≤ v < 4.4.24.4.0 5.0.0

Affected range stops below 4.3.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.2, so it looks safe — our inference, not a vendor statement

Crucible · Atlassianatlassian-app

95%

v < 4.8.10

Affected range stops below 4.8.10, so it looks safe — our inference, not a vendor statement

Fisheye · Atlassianatlassian-app

95%

v < 4.8.10

Affected range stops below 4.8.10, so it looks safe — our inference, not a vendor statement

Jira Data Center · Atlassianatlassian-app

95%

v ≥ 8.14.0v ≥ 8.21.0v < 8.13.22v < 8.20.10v < 8.22.48.13.0 ≤ v < 8.13.228.14.0 ≤ v < 8.20.108.21.0 ≤ v < 8.22.48.13.0 8.14.0 8.21.0

Affected range stops below 8.13.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.20.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.22.4, so it looks safe — our inference, not a vendor statement

Jira Server · Atlassianatlassian-app

95%

v ≥ 8.14.0v ≥ 8.21.0v < 8.13.22v < 8.20.10v < 8.22.48.13.0 ≤ v < 8.13.228.14.0 ≤ v < 8.20.108.21.0 ≤ v < 8.22.48.13.0 8.14.0 8.21.0

Affected range stops below 8.13.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.20.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.22.4, so it looks safe — our inference, not a vendor statement

Jira Service Desk · Atlassianatlassian-app

95%

v < 4.13.22

Affected range stops below 4.13.22, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references