CVE-2021-26071: CSRF

Q: What is CVE-2021-26071?

CVE-2021-26071 is a vulnerability that allows remote attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF).

Q: What software is affected by CVE-2021-26071?

CVE-2021-26071 affects Atlassian Data Center, Atlassian JIRA, Atlassian Jira Data Center, and Atlassian Jira Server.

Q: What is the severity of CVE-2021-26071?

CVE-2021-26071 has a severity rating of low (3.5).

Q: How can the CVE-2021-26071 vulnerability be exploited?

CVE-2021-26071 can be exploited by remote anonymous attackers using cross-site request forgery (CSRF) techniques.

Q: Where can I find more information about CVE-2021-26071?

You can find more information about CVE-2021-26071 on the Atlassian Jira bug tracker: https://jira.atlassian.com/browse/JRASERVER-72233

Published Apr 1, 2021

Updated

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

Affected Software

6 affected components

Atlassian Data Center<8.5.13

Atlassian Jira<8.5.13

Atlassian Jira Data Center>=8.6.0<8.13.5

Atlassian Jira Data Center>=8.14.0<8.15.1

Atlassian Jira Server>=8.6.0<8.13.5

Atlassian Jira Server>=8.14.0<8.15.1

Remediation

Patch Available

https://jira.atlassian.com/browse/JRASERVER-72233

Event History

Apr 1, 2021

CVE Published

via MITRE·02:30 AM

Data Sourced

via MITRE·02:30 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-26071?

CVE-2021-26071 is a vulnerability that allows remote attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF).

What software is affected by CVE-2021-26071?