CVE-2021-26070: High severity Atlassian Data Center vulnerability

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-26070.

Q: What is the severity rating of CVE-2021-26070?

The severity rating of CVE-2021-26070 is 7.2 (high).

Q: How can remote attackers exploit this vulnerability?

Remote attackers can exploit this vulnerability to bypass behind-the-firewall protection and access app-linked resources.

Q: Where can I find more information about this vulnerability?

More information about this vulnerability can be found at: https://jira.atlassian.com/browse/JRASERVER-72029.

Published Mar 22, 2021

Updated

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the makeRequest gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

Affected Software

4 affected components

Atlassian Data Center<8.13.3

Atlassian Data Center>=8.14.0<8.14.1

Atlassian Jira<8.13.3

Atlassian Jira Server>=8.14.0<8.14.1

Event History

Mar 22, 2021

CVE Published

via MITRE·04:40 AM

Data Sourced

via MITRE·04:40 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-26070.

What is the severity rating of CVE-2021-26070?

The severity rating of CVE-2021-26070 is 7.2 (high).

Which versions of Atlassian Jira Server and Data Center are affected?

Affected versions of Atlassian Jira Server and Data Center are before version 8.13.3 and from version 8.14.0 to 8.14.1.

How can remote attackers exploit this vulnerability?