Skip to content
Fencer Intel
critical 9.8

CVE-2022-26136 json

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third…

published 4y ago modified 4mo ago also EUVD-2022-30703

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.7%
EPSS 5.7% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Patch / fix

  • Atlassian Bamboo Server 8.0.9, 8.1.8, 8.2.4
  • Atlassian Bamboo Data Center 8.0.9, 8.1.8, 8.2.4
  • Atlassian Bitbucket Server 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Atlassian Bitbucket Data Center 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Atlassian Confluence Server 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Atlassian Confluence Data Center 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Atlassian Crowd Server 4.3.8, 4.4.2
  • Atlassian Crowd Data Center 4.3.8, 4.4.2
  • Atlassian Crucible 4.8.10
  • Atlassian Fisheye 4.8.10
  • Atlassian Jira Core Server 8.13.22, 8.20.10, 8.22.4
  • Atlassian Jira Software Server 8.13.22, 8.20.10, 8.22.4
  • Atlassian Jira Software Data Center 8.13.22, 8.20.10, 8.22.4
  • Atlassian Jira Service Management Server 4.13.22, 4.20.10, 4.22.4
  • Atlassian Jira Service Management Data Center 4.13.22, 4.20.10, 4.22.4
  • atlassian bamboo 7.2.10, 8.0.9, 8.1.8, 8.2.4
  • atlassian bitbucket 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • atlassian confluence_data_center 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • atlassian confluence_server 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • atlassian crowd 4.3.8, 4.4.2
  • atlassian jira_data_center 8.13.22, 8.20.10, 8.22.4
  • atlassian jira_server 8.13.22, 8.20.10, 8.22.4
  • atlassian jira_service_desk 4.13.22
  • atlassian jira_service_management 4.20.10, 4.22.4

Is CVE-2022-26136 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2y ago

Exploit prediction

5.66% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Atlassian Bamboo Server
  • Atlassian Bamboo Data Center
  • Atlassian Bitbucket Server
  • Atlassian Bitbucket Data Center
  • Atlassian Confluence Server
  • Atlassian Confluence Data Center
  • Atlassian Crowd Server
  • Atlassian Crowd Data Center
  • Atlassian Crucible
  • Atlassian Fisheye
  • Atlassian Jira Core Server
  • Atlassian Jira Software Server
  • Atlassian Jira Software Data Center
  • Atlassian Jira Service Management Server
  • Atlassian Jira Service Management Data Center
  • atlassian bamboo
  • atlassian bitbucket
  • atlassian confluence_data_center
  • atlassian confluence_server
  • atlassian crowd
  • atlassian jira_data_center
  • atlassian jira_server
  • atlassian jira_service_desk
  • atlassian jira_service_management

Classification

Weakness
  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-287 Improper Authentication

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.