CVE-2022-36800

4.3 mediumEPSS 0.7%

Medium (4.3) in atlassian jira service management. EPSS 0.7% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2022-08-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:jira_service_management

References

https://jira.atlassian.com/browse/JSDSERVER-11900
https://jira.atlassian.com/browse/JSDSERVER-11900

Check your stack JSON