Jira Authentication Problem Spurs Atlassian to Create a Patch
Table of Contents
- By Steven
- Published: Apr 26, 2022
- Last Updated: Sep 16, 2025
Atlassian is providing users of Jira with a digital security patch. The patch is in response to the identification of a flawed authentication bypass process. Atlassian’s brass has also taken to social media and other avenues to issue a security advisory warning of the digital security weakness within its Jira software.
Why is the Vulnerability Within Jira’s Authentication Bypass a Problem?
The fallibility of Jira software has the potential to be manipulated by a hacker located far away from their targets. An unauthenticated user could bypass Jira’s security safeguards and access the software without permission. A hacker could exploit the vulnerability by transmitting a unique HTTP request that bypasses authorization and authentication requirements within WebWork’s actions by way of a specialized configuration.
What Do We Know About the Vulnerability?
The vulnerability in question is officially referred to with the label CVE-2022-0540. On the CVSS scoring system, the weakness is rated as a 9.9 out of 10, meaning it is a significant threat. The vulnerability is located within the software’s authentication framework.
Who Identified the Weakness?
An employee with Viettel Cyber Security identified the digital security vulnerability within Jira’s software.
Which Jira Products Need the Patch?
The following Jira products have the vulnerability and should be patched as soon as possible: Jira Software Data Center, Jira Software Server, Jira Core Server, and all of their respective versions prior to 8.21.x, 8.13.18, 8.17.x, 8.18.x, 8.19.x, 8.14.x, 8.15.x, 8.16.x, 8.20.x, and 8.20.6. The digital security weakness also affects Jira Service Management Server, Jira Service Management Data Center, and their respective versions prior to 4.21.x, 4.20.6, 4.16.x, 4.17.x, 4.18.x, 4.19.x, 4.20.x, 4.13.18, 4.14.x, and 4.15.x.
Atlassian representatives have also stated that the digital security vulnerability pertains to both third-party and first-party apps if they are installed on Jira Service Management and regular Jira versions and use a configuration that is considered to be vulnerable. Jira customers who use the versions of the software listed above are advised to update to a patched version to minimize attempts at exploitation. However, if prompt patching is not feasible, Jira’s digital security specialists have stated it is prudent to update the compromised apps to the fixed versions noted below or simply disable them. In the meantime, teams needing to work with Jira data can still export Jira to CSV to maintain workflow continuity while addressing these security concerns.
Which Versions of the Company’s Software Have Been Fixed?
Jira representatives state Jira Service Management versions 4.22.0, 4.20.6, 4.13.18, 8.13.18, 8.22.0, and 8.20.6 have been fixed.
Is This Digital Vulnerability Atlassian’s First?
Atlassian has a solid track record of providing its customers with formidable digital security. However, it must be noted that the company’s Confluence software had a critical remote code execution fallibility last year. The flaw was officially labeled as CVE-2021-26084 and had a 9.8 CVSS score. The vulnerability was weaponized this past year. The weaponization installed crypto miners on the company’s servers.
