A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third…

Description

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Scores

EPSS (exploitation in 30 days)

5.7% · top 7.0% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• CWE-180: Incorrect Behavior Order: Validate Before Canonicalize (CWE-180). (opens in a new tab)All about CWE-180 and its CVEs
• CWE-287 (opens in a new tab)All about CWE-287 and its CVEs

Affected products

• Atlassian · Bamboo Server

  • affected unspecified – < 8.0.9
  • affected 8.1.0 – < unspecified
  • affected unspecified – < 8.1.8
  • affected 8.2.0 – < unspecified
  • affected unspecified – < 8.2.4

• Atlassian · Bamboo Data Center

  • affected unspecified – < 8.0.9
  • affected 8.1.0 – < unspecified
  • affected unspecified – < 8.1.8
  • affected 8.2.0 – < unspecified
  • affected unspecified – < 8.2.4

• Atlassian · Bitbucket Server

  • affected unspecified – < 7.6.16
  • affected 7.7.0 – < unspecified
  • affected 7.16.0 – < unspecified
  • affected unspecified – < 7.17.8
  • affected 7.18.0 – < unspecified
  • affected unspecified – < 7.19.5
  • affected 7.20.0 – < unspecified
  • affected unspecified – < 7.20.2
  • affected 7.21.0 – < unspecified
  • affected unspecified – < 7.21.2
  • affected 8.0.0
  • affected 8.1.0

• Atlassian · Bitbucket Data Center

  • affected unspecified – < 7.6.16
  • affected 7.7.0 – < unspecified
  • affected 7.16.0 – < unspecified
  • affected unspecified – < 7.17.8
  • affected 7.18.0 – < unspecified
  • affected unspecified – < 7.19.5
  • affected 7.20.0 – < unspecified
  • affected unspecified – < 7.20.2
  • affected 7.21.0 – < unspecified
  • affected unspecified – < 7.21.2
  • affected 8.0.0
  • affected 8.1.0

• Atlassian · Confluence Server

  • affected unspecified – < 7.4.17
  • affected 7.5.0 – < unspecified
  • affected unspecified – < 7.13.7
  • affected 7.14.0 – < unspecified
  • affected unspecified – < 7.14.3
  • affected 7.15.0 – < unspecified
  • affected unspecified – < 7.15.2
  • affected 7.16.0 – < unspecified
  • affected unspecified – < 7.16.4
  • affected 7.17.0 – < unspecified
  • affected unspecified – < 7.17.4
  • affected 7.18.0

• Atlassian · Confluence Data Center

  • affected unspecified – < 7.4.17
  • affected 7.5.0 – < unspecified
  • affected unspecified – < 7.13.7
  • affected 7.14.0 – < unspecified
  • affected unspecified – < 7.14.3
  • affected 7.15.0 – < unspecified
  • affected unspecified – < 7.15.2
  • affected 7.16.0 – < unspecified
  • affected unspecified – < 7.16.4
  • affected 7.17.0 – < unspecified
  • affected unspecified – < 7.17.4
  • affected 7.18.0

• Atlassian · Crowd Server

  • affected unspecified – < 4.3.8
  • affected 4.4.0 – < unspecified
  • affected unspecified – < 4.4.2
  • affected 5.0.0

• Atlassian · Crowd Data Center

  • affected unspecified – < 4.3.8
  • affected 4.4.0 – < unspecified
  • affected unspecified – < 4.4.2
  • affected 5.0.0

• Atlassian · Crucible

  • affected unspecified – < 4.8.10

• Atlassian · Fisheye

  • affected unspecified – < 4.8.10

• Atlassian · Jira Core Server

  • affected unspecified – < 8.13.22
  • affected 8.14.0 – < unspecified
  • affected unspecified – < 8.20.10
  • affected 8.21.0 – < unspecified
  • affected unspecified – < 8.22.4

• Atlassian · Jira Software Server

  • affected unspecified – < 8.13.22
  • affected 8.14.0 – < unspecified
  • affected unspecified – < 8.20.10
  • affected 8.21.0 – < unspecified
  • affected unspecified – < 8.22.4

• Atlassian · Jira Software Data Center

  • affected unspecified – < 8.13.22
  • affected 8.14.0 – < unspecified
  • affected unspecified – < 8.20.10
  • affected 8.21.0 – < unspecified
  • affected unspecified – < 8.22.4

• Atlassian · Jira Service Management Server

  • affected unspecified – < 4.13.22
  • affected 4.14.0 – < unspecified
  • affected unspecified – < 4.20.10
  • affected 4.21.0 – < unspecified
  • affected unspecified – < 4.22.4

• Atlassian · Jira Service Management Data Center

  • affected unspecified – < 4.13.22
  • affected 4.14.0 – < unspecified
  • affected unspecified – < 4.20.10
  • affected 4.21.0 – < unspecified
  • affected unspecified – < 4.22.4

References (8)

• https://jira.atlassian.com/browse/BAM-21795 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/BSERV-13370 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/CONFSERVER-79476 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/CWD-5815 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/FE-7410 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/CRUC-8541 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/JRASERVER-73897 (opens in a new tab)x_refsource_MISCx_transferred
• https://jira.atlassian.com/browse/JSDSERVER-11863 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-26136](https://trackcve.app/badge/CVE-2022-26136.svg)](https://trackcve.app/cve/CVE-2022-26136)

Record last updated 3 Oct 2024, 16:43 UTC.