Main Vulnerability Database Vulnerabilities #VU65891

Cross-site scripting in Atlassian products - CVE-2022-26136

Published: July 29, 2022

Vulnerability identifier: #VU65891

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2022-26136

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Servlet Filter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Affected software

Crowd Data Center
Crucible Server
Jira Service Management Server
Bamboo Server
Confluence Data Center
Bitbucket Data Center
Atlassian Fisheye
Jira Software Server

How to mitigate CVE-2022-26136

Install update from vendor's website.

Crowd Data Center - addressed in versions 4.3.8, 4.4.2, 5.0.1
Atlassian Fisheye - update to 4.8.10
Crucible Server - update to 4.8.10
Jira Service Management Server - addressed in versions 4.13.22, 4.20.10, 4.22.4, 4.22.6, 5.0.0
Bamboo Server - addressed in versions 7.2.10, 8.0.9, 8.1.8, 8.2.4, 9.0.0
Confluence Data Center - addressed in versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, 7.18.1
Bitbucket Data Center - addressed in versions 7.6.16, 7.17.8, 7.19.5, 7.20.2, 8.0.1, 8.1.1, 8.2.0
Jira Software Server - addressed in versions 8.13.22, 8.20.10, 8.22.6, 9.0.0

External References

Related Security Bulletins