{"id":"CVE-2022-0540","published":"2022-04-20T18:30:17Z","modified":"2024-10-24T16:54:19Z","title":"A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a…","vendor":"Atlassian","product":"Jira Core Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Jira Core Server","versions":[">= unspecified, < 8.13.18",">= 8.14.0, < unspecified",">= unspecified, < 8.20.6",">= 8.21.0, < unspecified",">= unspecified, < 8.22.0"]},{"vendor":"Atlassian","product":"Jira Software Server","versions":[">= unspecified, < 8.13.18",">= 8.14.0, < unspecified",">= unspecified, < 8.20.6",">= 8.21.0, < unspecified",">= unspecified, < 8.22.0"]},{"vendor":"Atlassian","product":"Jira Software Data Center","versions":[">= unspecified, < 8.13.18",">= 8.14.0, < unspecified",">= unspecified, < 8.20.6",">= 8.21.0, < unspecified",">= unspecified, < 8.22.0"]},{"vendor":"Atlassian","product":"Jira Service Management Server","versions":[">= unspecified, < 4.13.18",">= 4.14.0, < unspecified",">= unspecified, < 4.20.6",">= 4.21.0, < unspecified",">= unspecified, < 4.22.0"]},{"vendor":"Atlassian","product":"Jira Service Management Data Center","versions":[">= unspecified, < 4.13.18",">= 4.14.0, < unspecified",">= unspecified, < 4.20.6",">= 4.21.0, < unspecified",">= unspecified, < 4.22.0"]}],"description":{"text":"A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Jira Seraph component of Atlassian's Jira Core Server (and Jira Service Management Server) allows authentication to be bypassed. An unauthenticated attacker with network access can exploit it remotely by sending a specially crafted HTTP request, with no user interaction needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.88057,"percentile":0.99764,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-03-30","exploitedFirstSeen":"2024-03-30","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-30&host_type=src&vulnerability=cve-2022-0540","date":"2024-03-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-01&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-04&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-06&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-08&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-10&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-11&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-12&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-14&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-27&host_type=src&vulnerability=cve-2022-0540","date":"2024-04-27"}],"evidenceTotal":504,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Atlassian Jira Products Security Bypass Vulnerability","url":"https://otx.alienvault.com/pulse/626fadd204e07c90bf68ddb7","created":"2022-05-02"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20","tags":["x_refsource_MISC"]},{"url":"https://jira.atlassian.com/browse/JRASERVER-73650","tags":["x_refsource_MISC"]},{"url":"https://jira.atlassian.com/browse/JSDSERVER-11224","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-15662","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15662","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-05-25","earliestUrl":"https://github.com/Pear1y/CVE-2022-0540-RCE","repos":[{"name":"Pear1y/CVE-2022-0540-RCE","url":"https://github.com/Pear1y/CVE-2022-0540-RCE","stars":71,"created":"2022-05-25"}]},"nuclei":[{"id":"CVE-2022-0540","name":"Atlassian Jira Seraph - Authentication Bypass","severity":"critical","path":"http/cves/2022/CVE-2022-0540.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0540.yaml"}],"first":{"date":"2022-05-25","source":"PoC-in-GitHub","url":"https://github.com/Pear1y/CVE-2022-0540-RCE"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-04-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-0540","provenance":"source"},{"date":"2022-05-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Pear1y/CVE-2022-0540-RCE","provenance":"source"},{"date":"2024-03-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-30&host_type=src&vulnerability=cve-2022-0540","provenance":"source"}],"speed":{"daysToPublicExploit":35,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":67.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 943 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9976"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}