Read the docs
TI-2023-08748 Aliases CVE-2023-22501GHSA-jm25-87xp-4h76

Improper authentication in Atlassian Jira Service Management Data Center

Priority MEDIUM 63CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to signup tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: * If the attacker is included on Jira issues or requests with these users, or * If the attacker is forwarded or otherwise gains access to emails containing a “View Request” link from these users. Bot accounts are particularly susceptible to this scenario. On instances with single sign-on, external customer accounts can be affected in projects where anyone can create their own account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.15533 96th percentileScored 2026-11-07
Fix Fixed Jira Service Management Data Center (Atlassian): before 5.3.0, 5.3.3, 5.4.2 +2Jira Service Management Server (Atlassian): before 5.3.0, 5.3.3, 5.4.2 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Service Management Data Centerbefore 5.3.3; before 5.4.2; before 5.5.1; before 5.6.0before 5.3.0, 5.3.3, 5.4.2, 5.5.1, 5.6.0Patch availableCNA
AtlassianJira Service Management Serverbefore 5.3.3; before 5.4.2; before 5.5.1; before 5.6.0before 5.3.0, 5.3.3, 5.4.2, 5.5.1, 5.6.0Patch availableCNA
  • Jira Service Management Data Center VendorAtlassian Affected before 5.3.3; before 5.4.2; before 5.5.1; before 5.6.0 Fixed in before 5.3.0, 5.3.3, 5.4.2, 5.5.1, 5.6.0 Patch available CNA
  • Jira Service Management Server VendorAtlassian Affected before 5.3.3; before 5.4.2; before 5.5.1; before 5.6.0 Fixed in before 5.3.0, 5.3.3, 5.4.2, 5.5.1, 5.6.0 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*5.3.0 to before 5.3.3VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*5.3.0 to before 5.3.3VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*5.4.0 to before 5.4.2VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*5.4.0 to before 5.4.2VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:5.5.0:*:*:*:data_center:*:*:*5.5.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:5.5.0:*:*:*:server:*:*:*5.5.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 5.3.0 to before 5.3.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 5.3.0 to before 5.3.3 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 5.4.0 to before 5.4.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 5.4.0 to before 5.4.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:5.5.0:*:*:*:data_center:*:*:* Versions 5.5.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:5.5.0:*:*:*:server:*:*:* Versions 5.5.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in before 5.3.0, 5.3.3, 5.4.2, 5.5.1, 5.6.0
  • Fix · CNA Jira Service Management Server (Atlassian) Fixed in before 5.3.0, 5.3.3, 5.4.2, 5.5.1, 5.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22501
  2. 2026-10-03 Alias added: GHSA-jm25-87xp-4h76

References

Advisory 1

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-00460 Improper authentication in Atlassian Jira Core Server CVSS 3.1CRITICAL 9.8
  • TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
  • TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
  • TI-2022-09597 Server-side request forgery in Atlassian Jira Core Server CVSS 3.1MEDIUM 6.5
  • TI-2019-10436 initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler… CVSS 3.1CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences