CVE-2021-26082: XSS

Q: What is CVE-2021-26082?

CVE-2021-26082 is a vulnerability in Atlassian Jira Server and Jira Data Center that allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross-site scripting vulnerability.

Q: How does CVE-2021-26082 affect Atlassian Jira?

CVE-2021-26082 affects Atlassian Jira Server and Jira Data Center versions before 8.5.14, versions 8.6.0 to 8.13.6, and versions 8.14.0 to 8.17.0.

Q: What is the severity of CVE-2021-26082?

CVE-2021-26082 has a severity rating of medium with a CVSS score of 5.4.

Q: How can I fix CVE-2021-26082?

To fix CVE-2021-26082, you should upgrade to Atlassian Jira Server or Jira Data Center version 8.5.14 or later.

Q: Where can I find more information about CVE-2021-26082?

You can find more information about CVE-2021-26082 at the Atlassian Jira Server and Jira Data Center issue tracker: https://jira.atlassian.com/browse/JRASERVER-72393

Published Jul 20, 2021

Updated

The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.

Affected Software

6 affected components

Atlassian Data Center<8.5.14

Atlassian Jira<8.5.14

Atlassian Jira Data Center>=8.6.0<8.13.6

Atlassian Jira Data Center>=8.14.0<8.17.0

Atlassian Jira Server>=8.6.0<8.13.6

Atlassian Jira Server>=8.14.0<8.17.0

Remediation

Patch Available

https://jira.atlassian.com/browse/JRASERVER-72393

Event History

Jul 20, 2021

CVE Published

via MITRE·03:25 AM

Data Sourced

via MITRE·03:25 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-26082?

CVE-2021-26082 is a vulnerability in Atlassian Jira Server and Jira Data Center that allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross-site scripting vulnerability.

How does CVE-2021-26082 affect Atlassian Jira?