What’s Vulnerable › Vulnerabilities

CVE-2022-39960

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 25.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-17 · updated 2026-06-17
• Weakness: CWE-862

Description

The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/ URI.

Affected products

• Netic Group Export: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Netic Group Export 1.0.3. Check the vendor advisory for mitigations.

References

• https://gist.github.com/CveCt0r/ca8c6e46f536e9ae69fc6061f132463e
• https://marketplace.atlassian.com/apps/1222388/group-export-for-jira/version-history
• https://gist.github.com/CveCt0r/ca8c6e46f536e9ae69fc6061f132463e
• https://marketplace.atlassian.com/apps/1222388/group-export-for-jira/version-history

Get alerted when CVE-2022-39960 or the next vulnerability affects your stack