VULNERABILITY INTELLIGENCE

CVE-2022-36800

CVSS score4.3 MEDIUM

EPSS probability0.65%

CISA KEVNot currently listed

Published2022-08-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2.

Weakness classification

nvd@nist.gov: NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-732

Primary references

security@atlassian.com — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory