How severe is CVE-2022-36802?

CVE-2022-36802 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2022-36802 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-36802?

CVE-2022-36802 affects Atlassian Jira Align. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-36802?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-36802 published?

CVE-2022-36802 was published on 2022-10-14 and last updated on 2026-06-17.

CVE-2022-36802

CVE-2022-36802 is a medium-severity vulnerability in Atlassian Jira Align with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 4.9)
EPSS exploit prediction: 1% (59th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-918
Affected product: Atlassian Jira Align
Published: 2022-10-14
Last modified: 2026-06-17

Description

The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.

Frequently asked questions

What is CVE-2022-36802?: The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.
How severe is CVE-2022-36802?: CVE-2022-36802 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2022-36802 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (59th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-36802?: CVE-2022-36802 affects Atlassian Jira Align. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-36802?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-36802 published?: CVE-2022-36802 was published on 2022-10-14 and last updated on 2026-06-17.

References

https://jira.atlassian.com/browse/JIRAALIGN-4326

Affected products (1)

cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*

More vulnerabilities in Atlassian Jira Align

CVE-2022-36803 — High (CVSS 8.8): The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the…
CVE-2025-22175 — Medium (CVSS 5.4): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22169 — Medium (CVSS 5.4): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22178 — Medium (CVSS 4.3): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22177 — Medium (CVSS 4.3): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…
CVE-2025-22176 — Medium (CVSS 4.3): Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose…

All CVEs affecting Atlassian Jira Align →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-54734 — Critical (CVSS 10.0): Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate…
CVE-2026-76193 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in…
CVE-2026-69502 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a…
CVE-2026-65801 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges…
CVE-2026-48331 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in…
CVE-2026-54735 — Critical (CVSS 10.0): Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →