CVE-2022-36800: 
Jira Service Management vulnerability analysis and mitigation

Affected versions of Atlassian Jira Service Management Server and Data Center contain an Information Disclosure vulnerability (CVE-2022-36800) that was discovered in July 2022. The vulnerability allows remote attackers without the "Browse Users" permission to view groups through the browsegroups.action endpoint. The affected versions are before version 4.22.2 (Jira Issue).

The vulnerability exists in the browsegroups.action endpoint of Jira Service Management Server and Data Center. It allows unauthorized access to group information by bypassing the "Browse Users" permission check. The vulnerability has been assigned a CVSS Score of 3.5 (Medium severity) (Jira Issue).

When exploited, this vulnerability allows remote attackers to view group information in Jira Service Management instances, even without having the required "Browse Users" permission. This represents an information disclosure risk that could expose organizational structure and user group memberships (Jira Issue).

The vulnerability can be exploited by remote attackers who don't have the "Browse Users" permission by accessing the browsegroups.action endpoint (Jira Issue).

The vulnerability has been fixed in Jira Service Management Server and Data Center version 4.22.2. Organizations running affected versions should upgrade to version 4.22.2 or later to mitigate this security risk (Jira Issue).