CVE-2025-22170

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22170", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2025-01-01T00:01:27.177Z", "datePublished": "2025-10-22T16:30:04.355Z", "dateUpdated": "2025-10-22T19:16:07.138Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"version": "< 11.14.0", "status": "unaffected"}, {"version": ">= 11.14.0", "status": "affected"}, {"version": ">= 11.14.1", "status": "affected"}, {"version": ">= 11.15.0", "status": "affected"}, {"version": ">= 11.15.1", "status": "affected"}, {"version": ">= 11.16.0", "status": "affected"}, {"version": ">= 11.16.1", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action."}], "problemTypes": [{"descriptions": [{"description": "Improper Authorization", "lang": "en", "type": "Improper Authorization"}]}], "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8639"}], "credits": [{"lang": "en", "value": "Frank Lycops, NATO Cyber Security Centre"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2025-10-22T16:30:04.355Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T19:16:03.345408Z", "id": "CVE-2025-22170", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T19:16:07.138Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22170", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T19:16:03.345408Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T19:15:56.027Z"}}], "cna": {"credits": [{"lang": "en", "value": "Frank Lycops, NATO Cyber Security Centre"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}], "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8639"}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "Improper Authorization", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2025-10-22T16:30:04.355Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22170", "state": "PUBLISHED", "dateUpdated": "2025-10-22T19:16:07.138Z", "dateReserved": "2025-01-01T00:01:27.177Z", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2025-10-22T16:30:04.355Z", "assignerShortName": "atlassian"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Jira Align", "vendor": "Atlassian", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}], "source": "security@atlassian.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE85D038-4C13-4104-B53E-F3022F5D8117", "versionEndExcluding": "11.16.1", "versionStartIncluding": "11.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action."}, {"lang": "es", "value": "Jira Align es vulnerable a un problema de autorizaci\u00f3n. Un usuario con pocos privilegios sin privilegios suficientes para realizar una acci\u00f3n podr\u00eda hacerlo si incluyera un par\u00e1metro particular relacionado con el estado de un usuario con privilegios suficientes para realizar la acci\u00f3n."}], "id": "CVE-2025-22170", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@atlassian.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22170", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T19:16:03.345408Z", "version": "2.0.3"}}]}, "published": "2025-10-22T17:15:57.387", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JIRAALIGN-8639"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-10-23T09:59:16.588247+00:00", "updated": "2025-10-23T09:59:16.588273+00:00", "vendors": ["atlassian", "atlassian$PRODUCT$jira_align"]}