CVE-2022-36803

EPSS 0.38%
Veröffentlicht 14.10.2022 04:15:13
Zuletzt bearbeitet 21.11.2024 07:13:48
Quelle security@atlassian.com
CVE-Watchlists
Login
Unerledigt
Login

The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Atlassian ≫ Jira Align Version < 10.109.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.38%	0.584

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://jira.atlassian.com/browse/JIRAALIGN-4281

Vendor Advisory

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2022-36803

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-36803

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-36803

EUVD