PT-2022-6074 · Atlassian · Jira Align Server

Jacob Shafer · Published 2022-07-26 · Updated 2024-10-02 · CVE-2022-36803

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atlassian Jira Align Server versions prior to 10.109.2

Description The issue is related to the MasterUserEdit API in Atlassian Jira Align Server, which allows an authenticated attacker with the People role permission to modify any user's role to Super Admin. This is due to errors in access control. The vulnerability was reported by Jacob Shafer from Bishop Fox.

Recommendations For versions prior to 10.109.2, update to version 10.109.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the MasterUserEdit API to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2023-00009

CVE-2022-36803

Affected Products

Jira Align Server

References · 8

• https://bdu.fstec.ru/vul/2023-00009 · Security Note
• https://jira.atlassian.com/browse/JIRAALIGN-4281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36803 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36803 · Vendor Advisory
• https://t.me/cibsecurity/51392 · Telegram Post
• https://vuldb.com/?id.210824 · Note
• https://t.me/true_secator/3623 · Telegram Post
• https://t.me/cvenotify/96815 · Telegram Post