Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-72392

Vulnerability in Search Template Leads to Reflected XSS JIRA Software Server - CVE-2021-26078

XMLWordPrintable

    • 4.7
    • Medium
    • CVE-2021-26078

      Affected versions of Jira Server and Jira Data Center have a XSS vulnerability in the number range searcher component which allows remote attackers to inject arbitrary HTML or JavaScript.

      Affected versions:

      • versions < 8.5.14
      • 8.6.0 ≤ version <  8.13.6
      • 8.14.0 ≤ version < 8.16.1

      Fixed versions:

      • 8.5.14
      • 8.13.6
      • 8.16.1
      • 8.17.0

            [JRASERVER-72392] Vulnerability in Search Template Leads to Reflected XSS JIRA Software Server - CVE-2021-26078

            Prerana Shenoy added a comment -

            Hey Oli, 

            This security issue has been patched and rolled out in the `Fix Versions` mentioned in the ticket. 

            The issue has been mitigated.

            Thanks,

            Prerana

            Prerana Shenoy added a comment - Hey Oli,  This security issue has been patched and rolled out in the `Fix Versions` mentioned in the ticket.  The issue has been mitigated. Thanks, Prerana

            CaptainHook added a comment -

            Hey,

            In your Bugbounty program on Bugcrowd

            with this reference ID: 1286ca38c33de2fe058e9c357f5637778f85c1138853034796b14c3e636ba66d

            CaptainHook added a comment - Hey, In your Bugbounty program on Bugcrowd with this reference ID: 1286ca38c33de2fe058e9c357f5637778f85c1138853034796b14c3e636ba66d

            Oliver Liebing added a comment -

            Hi,
            where can can I find detailed information about this possible security breach or how to check our system if it's relevant for us?

            Regards,
            Oli

            Oliver Liebing added a comment - Hi, where can can I find detailed information about this possible security breach or how to check our system if it's relevant for us? Regards, Oli

            Prerana Shenoy added a comment -

            Yes, CVE-2021-26078 is now filed for this issue.

            Prerana Shenoy added a comment - Yes, CVE-2021-26078 is now filed for this issue.

            CaptainHook added a comment -

            Hi Did you file **

            CaptainHook added a comment - Hi Did you file ** CVE-2021-26078 for this issue?

            CaptainHook added a comment - - edited

            Hi b8165329c845 , thanks I will be waiting here.

            CaptainHook added a comment - - edited Hi b8165329c845 , thanks I will be waiting here.

            Prerana Shenoy added a comment -

            Hi 975e6b46bd8f, I will check if there is a CVE already and if not I can go ahead and file one. I will update you on what I end up doing.

            Prerana Shenoy added a comment - Hi 975e6b46bd8f , I will check if there is a CVE already and if not I can go ahead and file one. I will update you on what I end up doing.

            CaptainHook added a comment -

            @b8165329c845 Would you please manage my request?

            CaptainHook added a comment - @ b8165329c845 Would you please manage my request?

            CaptainHook added a comment -

            Hi thanks for Resolving this issue

            Is this issue qualify for CVE id or not

            CaptainHook added a comment - Hi thanks for Resolving this issue Is this issue qualify for CVE id or not

            Prerana Shenoy added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.

            CVSS v3 score: 4.7 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity High
            Privileges Required None
            User Interaction Required

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality Low
            Integrity Low
            Availability None

            See http://go.atlassian.com/cvss for more details.

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

            Prerana Shenoy added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 4.7 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity Low Availability None See http://go.atlassian.com/cvss for more details. https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: