CVE-2025-22175

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22175", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "state": "PUBLISHED", "assignerShortName": "atlassian", "dateReserved": "2025-01-01T00:01:27.177Z", "datePublished": "2025-10-22T16:30:00.592Z", "dateUpdated": "2025-10-27T16:09:06.998Z"}, "containers": {"cna": {"affected": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"version": "< 11.14.0", "status": "unaffected"}, {"version": ">= 11.14.0", "status": "affected"}, {"version": ">= 11.14.1", "status": "affected"}, {"version": ">= 11.15.0", "status": "affected"}, {"version": ">= 11.15.1", "status": "affected"}, {"version": ">= 11.16.0", "status": "affected"}, {"version": ">= 11.16.1", "status": "unaffected"}]}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist."}], "problemTypes": [{"descriptions": [{"description": "Improper Authorization", "lang": "en", "type": "Improper Authorization"}]}], "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8644"}], "credits": [{"lang": "en", "value": "Frank Lycops, NATO Cyber Security Centre"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2025-10-22T16:30:00.592Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T18:08:17.435004Z", "id": "CVE-2025-22175", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T16:09:06.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22175", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T18:08:17.435004Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T18:08:28.329Z"}}], "cna": {"credits": [{"lang": "en", "value": "Frank Lycops, NATO Cyber Security Centre"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "Atlassian", "product": "Jira Align", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}], "references": [{"url": "https://jira.atlassian.com/browse/JIRAALIGN-8644"}], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "Improper Authorization", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian", "dateUpdated": "2025-10-22T16:30:00.592Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22175", "state": "PUBLISHED", "dateUpdated": "2025-10-27T16:09:06.998Z", "dateReserved": "2025-01-01T00:01:27.177Z", "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "datePublished": "2025-10-22T16:30:00.592Z", "assignerShortName": "atlassian"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Jira Align", "vendor": "Atlassian", "versions": [{"status": "unaffected", "version": "< 11.14.0"}, {"status": "affected", "version": ">= 11.14.0"}, {"status": "affected", "version": ">= 11.14.1"}, {"status": "affected", "version": ">= 11.15.0"}, {"status": "affected", "version": ">= 11.15.1"}, {"status": "affected", "version": ">= 11.16.0"}, {"status": "unaffected", "version": ">= 11.16.1"}]}], "source": "security@atlassian.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_align:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE85D038-4C13-4104-B53E-F3022F5D8117", "versionEndExcluding": "11.16.1", "versionStartIncluding": "11.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist."}, {"lang": "es", "value": "Jira Align es vulnerable a un problema de autorizaci\u00f3n. Un usuario con pocos privilegios puede acceder a puntos finales inesperados que divulgan una peque\u00f1a cantidad de informaci\u00f3n sensible. Por ejemplo, un usuario de bajo nivel pudo modificar los pasos de la lista de verificaci\u00f3n privada de otro usuario."}], "id": "CVE-2025-22175", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@atlassian.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-22175", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T18:08:17.435004Z", "version": "2.0.3"}}]}, "published": "2025-10-22T17:15:57.940", "references": [{"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/JIRAALIGN-8644"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-10-23T09:59:15.167120+00:00", "updated": "2025-10-23T09:59:15.167145+00:00", "vendors": ["atlassian", "atlassian$PRODUCT$jira_align"]}