[JRASERVER-72978] Unicode characters allow malicious code to be hidden from a human reviewer (Jira Server) - CVE-2021-42574 - Create and track feature requests for Atlassian products.

Type: Public Security Vulnerability
Resolution: Fixed
Priority: Low (View bug fix roadmap)
Fix Version/s: 8.13.13, 8.20.1
Affects Version/s: 8.13.12, 8.20.0
Component/s: None
Labels:

CVSS Score:
7.1
CVSS Severity:
High
CVE ID:
CVE-2021-42574

Researchers at the University of Cambridge reported a vulnerability affecting Jira Server / DC where special characters, known as Unicode bidirectional override characters, are not rendered or displayed in the affected applications. These special characters are typically not displayed by the browser or code editors but can affect the meaning of the source code when it is processed by a compiler or an interpreter. The issue is now fixed.

Affected versions:

All versions before 8.13.13

All versions between 8.14.0 and 8.19.1 (inclusive)

All 8.20.x LTS versions before 8.20.1

Fixed versions:

8.13.13

8.20.1

mentioned in: Page Failed to load; Page Failed to load

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 17 Start watching this issue

Created:: 01/Nov/2021 9:59 PM

Updated:: 08/Sep/2023 4:56 PM

Resolved:: 01/Nov/2021 10:25 PM

Jira Data Center

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-72978] Unicode characters allow malicious code to be hidden from a human reviewer (Jira Server) - CVE-2021-42574

People

Dates