ID:7889 - Exploit for Improper Authentication in Atlassian products - CVE-2022-0540

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the Jira Seraph. A remote attacker can send a specially crafted HTTP request to bypass authentication and authorization requirements in WebWork actions and gain unauthorized access to the application.

The vulnerability affects applications that specify roles-required at the webwork1 action namespace level and do not specify it at an action level.

Remediation