CVE-2021-26069
First published: Mon Mar 22 2021(Updated: )
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Data Center | <8.5.11 | |
| Atlassian Data Center | >=8.6.0<8.13.3 | |
| Atlassian Jira | <8.5.11 | |
| Atlassian Data Center | >=8.14.0<8.15.0 | |
| Atlassian Server | >=8.6.0<8.13.3 | |
| Atlassian Server | >=8.14.0<8.15.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-26069?
CVE-2021-26069 is a vulnerability in Atlassian Jira Server and Data Center that allows unauthenticated remote attackers to download temporary files and enumerate project keys.
What are the affected versions of Atlassian Jira Server and Data Center?
The affected versions are before version 8.5.11 for Atlassian Jira Server and before version 8.6.0 to 8.13.3 for Atlassian Jira Data Center.
What is the severity of CVE-2021-26069?
CVE-2021-26069 has a severity rating of medium (5.3).
How does CVE-2021-26069 work?
CVE-2021-26069 allows unauthenticated remote attackers to exploit an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint to download temporary files and enumerate project keys.
Is there a fix for CVE-2021-26069?
Yes, upgrading to a version that is not affected by the vulnerability is the recommended fix for CVE-2021-26069.
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/remedy
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/atlassian
- canonical/atlassian data center
- version/atlassian data center/8.6.0
- canonical/atlassian jira
- version/atlassian data center/8.14.0
- canonical/atlassian server
- version/atlassian server/8.6.0
- version/atlassian server/8.14.0