CVE-2021-26071

Published: Apr 1, 2021Modified: Nov 21, 2024

3.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.1 / Impact: 1.4

Source: NVD

Description

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

Affected (6)

Products: Atlassian: Data Center, Jira, Jira Data Center, Jira Server

4 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Atlassian Data Center	Before 8.5.13
Atlassian Jira	Before 8.5.13
Atlassian Jira Data Center	From 8.14.0 to 8.15.1
Atlassian Jira Data Center	From 8.6.0 to 8.13.5
Atlassian Jira Server	From 8.14.0 to 8.15.1
Atlassian Jira Server	From 8.6.0 to 8.13.5

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://jira.atlassian.com/browse/JRASERVER-72233

Source: security@atlassian.com

PatchVendor Advisory

https://jira.atlassian.com/browse/JRASERVER-72233

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.