Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html | Exploit Third Party Advisory VDB Entry |
| https://jira.atlassian.com/browse/JRASERVER-72695 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Mar 2022, 13:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html - Exploit, Third Party Advisory, VDB Entry | |
| First Time |
Atlassian jira Server
Atlassian jira Data Center |
|
| CPE | cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* |
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* |
05 Oct 2021, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Aug 2021, 11:05
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| References | (MISC) https://jira.atlassian.com/browse/JRASERVER-72695 - Issue Tracking, Vendor Advisory | |
| CPE | cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
16 Aug 2021, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-16 01:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-26086
Mitre link : CVE-2021-26086
CVE.ORG link : CVE-2021-26086
JSON object : View
Products Affected
atlassian
- jira_data_center
- jira_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')