Vulnerability · Published Apr 14, 2021 · Assigned by atlassian
CVE-2021-26076
Low 3.7
In plain English
A low-severity security flaw in Jira Data Center from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)3.7Low
Exploit odds (30 days)1.3%top 29.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira Server | unspecified – before 8.5.128.6.0 – before unspecifiedunspecified – before 8.13.48.14.0 – before unspecifiedunspecified – before 8.15.0 |
| Atlassian | Jira Data Center | unspecified – before 8.5.128.6.0 – before unspecifiedunspecified – before 8.13.48.14.0 – before unspecifiedunspecified – before 8.15.0 |
References
- https://jira.atlassian.com/browse/JRASERVER-72252 x_refsource_MISC