CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Other sources
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlassian Jira Server and Data Centerto a version that resolves this vulnerability.Fixed in 8.5.14 - Upgrade
Upgrade
Atlassian Jira Server and Data Centerto a version that resolves this vulnerability.Fixed in 8.13.6 - Upgrade
Upgrade
Atlassian Jira Server and Data Centerto a version that resolves this vulnerability.Fixed in 8.16.1
Event History
Frequently Asked Questions
What is vulnerability CVE-2021-26086?
Vulnerability CVE-2021-26086 is a path traversal vulnerability in the /WEB-INF/web.xml endpoint of Atlassian Jira Server and Data Center.
What can a remote attacker do with CVE-2021-26086?
A remote attacker can read particular files on the affected Atlassian Jira Server and Data Center versions.
Which versions of Atlassian Jira Server and Data Center are affected by CVE-2021-26086?
The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
How severe is vulnerability CVE-2021-26086?
Vulnerability CVE-2021-26086 has a severity rating of 5.3 (medium).
Where can I find more information about vulnerability CVE-2021-26086?
You can find more information about vulnerability CVE-2021-26086 at the following references: [Packet Storm Security](http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html) and [Atlassian Jira Issue Tracker](https://jira.atlassian.com/browse/JRASERVER-72695).