CVE-2025-22170

Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jira.atlassian.com/browse/JIRAALIGN-8639	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Jira Align es vulnerable a un problema de autorización. Un usuario con pocos privilegios sin privilegios suficientes para realizar una acción podría hacerlo si incluyera un parámetro particular relacionado con el estado de un usuario con privilegios suficientes para realizar la acción.

Information

Published : 2025-10-22 17:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-22170

Mitre link : CVE-2025-22170

CVE.ORG link : CVE-2025-22170

JSON object : View

Products Affected

atlassian

jira_align

CWE

CWE-285

Improper Authorization

{"id": "CVE-2025-22170", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22170", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T19:16:03.345408Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@atlassian.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@atlassian.com", "affectedData": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}]}], "published": "2025-10-22T17:15:57.387", "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8639", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action."}, {"lang": "es", "value": "Jira Align es vulnerable a un problema de autorizaci\u00f3n. Un usuario con pocos privilegios sin privilegios suficientes para realizar una acci\u00f3n podr\u00eda hacerlo si incluyera un par\u00e1metro particular relacionado con el estado de un usuario con privilegios suficientes para realizar la acci\u00f3n."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE85D038-4C13-4104-B53E-F3022F5D8117", "versionEndExcluding": "11.16.1", "versionStartIncluding": "11.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}