QID 150559

Jira is a proprietary issue tracking product, product developed by Atlassian. It provides bug tracking, issue tracking, and project management functions.

Multiple Vulnerabilities are identified in Atlassian Jira Server and Data Center:

Arbitrary Servlet Filter Bypass (CVE-2022-26136): This vulnerability allows an unauthenticated threat actor to bypass Servlet Filters used by first- and third-party applications.
Additional Servlet Filter Invocation (CVE-2022-26137): This vulnerability allows a remote, unauthenticated threat actor to invoke additional Servlet Filters when the application processes a request or response.

Affected versions:
before version 8.13.22
from version 8.14.0 before 8.19.1
from version 8.20.0 before 8.20.10
from version 8.21.0 before 8.21.1
from version 8.22.0 before 8.22.4

QID Detection Logic:(Unauthenticated):
It checks for vulnerable version of Atlassian Jira Server.

A remote, unauthenticated attacker can bypass Servlet Filters used by first and third party apps or can cause additional Servlet Filters to be invoked when the application processes requests or responses.