CVE-2021-39126

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.
References
Link Resource
https://jira.atlassian.com/browse/JRASERVER-71806 Issue Tracking Patch Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-71806 Issue Tracking Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:18

Type Values Removed Values Added
References () https://jira.atlassian.com/browse/JRASERVER-71806 - Issue Tracking, Patch, Vendor Advisory () https://jira.atlassian.com/browse/JRASERVER-71806 - Issue Tracking, Patch, Vendor Advisory

15 Apr 2022, 15:29

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
CVSS v2 : 6.8
v3 : 8.8
v2 : 4.3
v3 : 6.5

14 Mar 2022, 02:15

Type Values Removed Values Added
Summary Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2. Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.

25 Oct 2021, 20:42

Type Values Removed Values Added
CWE CWE-352
CPE cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 6.8
v3 : 8.8
References (MISC) https://jira.atlassian.com/browse/JRASERVER-71806 - (MISC) https://jira.atlassian.com/browse/JRASERVER-71806 - Issue Tracking, Patch, Vendor Advisory

21 Oct 2021, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2021-10-21 03:15

Updated : 2024-11-21 06:18


NVD link : CVE-2021-39126

Mitre link : CVE-2021-39126

CVE.ORG link : CVE-2021-39126


JSON object : View

Products Affected

atlassian

  • jira_server
  • jira_data_center
CWE
CWE-352

Cross-Site Request Forgery (CSRF)