CVE-2022-36802

Published: Oct 14, 2022Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.

Affected (1)

Products: Atlassian: Jira Align

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Atlassian Jira Align	Before 10.109.2

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://jira.atlassian.com/browse/JIRAALIGN-4326

Source: security@atlassian.com

Permissions RequiredVendor Advisory

https://jira.atlassian.com/browse/JIRAALIGN-4326

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions RequiredVendor Advisory

Timeline

No history available yet.