1. Home
  2. CVE Database
  3. CVE-2021-26070
HIGH · 7.2

CVE-2021-26070

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `make...

Vulnerability Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
AtlassianData Center< 8.13.3
AtlassianJira< 8.13.3
AtlassianJira Server>= 8.14.0, < 8.14.1

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2021-26070?

CVE-2021-26070 is a vulnerability with a CVSS score of 7.2 (HIGH). Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `make...

How severe is CVE-2021-26070?

CVE-2021-26070 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-26070?

Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Data Center, Atlassian Jira, Atlassian Jira Server.