Skip to content
Back to search

CVE-2022-0540

CRITICAL
9.8NVD

Summary

generated automatically from NVD data

CVE-2022-0540 is an authentication bypass in Jira Seraph, the component used by Atlassian Jira Server and Data Center and by Jira Service Management Server and Data Center. A remote, unauthenticated attacker can send a specially crafted HTTP request to skip authentication (CWE-287). Affected Jira releases include those before 8.13.18, 8.14.0 up to before 8.20.6, and 8.21.0 up to before 8.22.0, with matching 4.x ranges for Service Management. The CVSS v3.1 score is 9.8 (CRITICAL).

NVD description

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.

Share:

EPSS · FIRST.org

88.1%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v3.1 Score

9.8
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
20 avr. 2022
Updated
17 juin 2026
Status
Modified
Source
security@atlassian.com

Affected products

atlassian jira data center
Versions : 8.13.8, 8.20.6, 8.22.0
atlassian jira server
Versions : 8.13.8, 8.20.6, 8.22.0
atlassian jira service management
Versions : 4.13.8, 4.13.18, 4.20.6, 4.22.0

Weaknesses (CWE)

NVD-CWE-noinfoCWE-287

References (6)

Similar CVEs

Other vulnerabilities of type CWE-287

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring