How severe is CVE-2022-36802?

CVE-2022-36802 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2022-36802 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-36802?

CVE-2022-36802 affects Atlassian Jira Align. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-36802?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-36802 published?

CVE-2022-36802 was published on 2022-10-14 and last updated on 2026-06-17.

CVE-2022-36802

CVE-2022-36802 is a medium-severity vulnerability in Atlassian Jira Align with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 4.9)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-918
Affected product: Atlassian Jira Align
Published: 2022-10-14
Last modified: 2026-06-17

Description

The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.

Frequently asked questions

What is CVE-2022-36802?: The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.
How severe is CVE-2022-36802?: CVE-2022-36802 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2022-36802 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-36802?: CVE-2022-36802 affects Atlassian Jira Align. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-36802?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-36802 published?: CVE-2022-36802 was published on 2022-10-14 and last updated on 2026-06-17.

References

https://jira.atlassian.com/browse/JIRAALIGN-4326

Affected products (1)

cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*

More vulnerabilities in Atlassian Jira Align

CVE-2022-36803 — High (CVSS 8.8): The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the…
CVE-2025-22175 — Medium (CVSS 5.4): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22169 — Medium (CVSS 5.4): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22178 — Medium (CVSS 4.3): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22177 — Medium (CVSS 4.3): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22176 — Medium (CVSS 4.3): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…

All CVEs affecting Atlassian Jira Align →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →