CVE-2021-26076: Medium severity atlassian data center vulnerability
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-26076?
CVE-2021-26076 is a vulnerability in the Jira Editor Plugin in Jira Server and Data Center.
How does CVE-2021-26076 impact Atlassian Jira?
CVE-2021-26076 allows remote anonymous attackers to learn information about Jira users.
What is the severity of CVE-2021-26076?
The severity of CVE-2021-26076 is medium with a CVSS score of 3.7.
Which versions of Atlassian Jira are affected by CVE-2021-26076?
CVE-2021-26076 affects Atlassian Jira versions 8.5.12, 8.6.0 to 8.13.4, and 8.14.0 to 8.15.0.
How can I fix CVE-2021-26076?
To fix CVE-2021-26076, update Jira Server or Data Center to version 8.5.12 or higher.