Authentication bypass in Jira (CVE 2022 0540) vulnerability if JIRA is internal on the network only

Robert Radu_jwnaom

Regarding the recently announced critical security advisory for CVE-2022-0540 regarding Authentication bypass in JIRA Server, is this still a critical vulnerability if the JIRA instance is confined to the internal network only and is not accessible from the internet?

Brian Roberts

That's a question only you and your org's security team (if you have one) can answer for sure. If you trust everyone with access to your internal network, then it may not be so critical for you because only people on your internal network would be able to exploit it.