Vulnerability Description
The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Data Center | < 8.5.13 |
| Atlassian | Jira | < 8.5.13 |
| Atlassian | Jira Data Center | >= 8.6.0, < 8.13.5 |
| Atlassian | Jira Server | >= 8.6.0, < 8.13.5 |
Related Weaknesses (CWE)
References
- https://jira.atlassian.com/browse/JRASERVER-72233PatchVendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-72233PatchVendor Advisory
FAQ
What is CVE-2021-26071?
CVE-2021-26071 is a vulnerability with a CVSS score of 3.5 (LOW). The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymou...
How severe is CVE-2021-26071?
CVE-2021-26071 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-26071?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Data Center, Atlassian Jira, Atlassian Jira Data Center, Atlassian Jira Server.