CVE-2021-26081
First published: Tue Jul 20 2021(Updated: )
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.
Credit: security@atlassian.com security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Data Center | <8.5.14 | |
| Atlassian JIRA | <8.5.14 | |
| Atlassian Jira Data Center | >=8.6.0<8.13.6 | |
| Atlassian Jira Data Center | >=8.14.0<8.16.1 | |
| Atlassian Jira Server | >=8.6.0<8.13.6 | |
| Atlassian Jira Server | >=8.14.0<8.16.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-26081?
CVE-2021-26081 is a vulnerability that exists in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
How does CVE-2021-26081 affect Atlassian Jira?
CVE-2021-26081 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint of Atlassian Jira Server and Jira Data Center.
What is the severity of CVE-2021-26081?
The severity of CVE-2021-26081 is medium, with a CVSSv3 score of 5.3.
Which software versions are affected by CVE-2021-26081?
CVE-2021-26081 affects Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
How can I fix CVE-2021-26081?
To fix CVE-2021-26081, it is recommended to upgrade your Atlassian Jira Server or Jira Data Center to version 8.5.14, 8.13.6, or 8.16.1 or later.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/references
- agent/author
- agent/remedy
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/atlassian
- canonical/atlassian data center
- canonical/atlassian jira
- canonical/atlassian jira data center
- version/atlassian jira data center/8.6.0
- version/atlassian jira data center/8.14.0
- canonical/atlassian jira server
- version/atlassian jira server/8.6.0
- version/atlassian jira server/8.14.0