CVE-2021-39126

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-39126
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://jira.atlassian.com/browse/JRASERVER-71806 Issue Tracking Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
History

15 Apr 2022, 15:29

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*		 cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
First Time Atlassian jira Server
Atlassian jira Data Center
CVSS v2 : 6.8
v3 : 8.8 		v2 : 4.3
v3 : 6.5

14 Mar 2022, 02:15

Type Values Removed Values Added
Summary Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2. Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.

25 Oct 2021, 20:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 6.8
v3 : 8.8
CPE cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
References (MISC) https://jira.atlassian.com/browse/JRASERVER-71806 - (MISC) https://jira.atlassian.com/browse/JRASERVER-71806 - Issue Tracking, Patch, Vendor Advisory
CWE CWE-352

21 Oct 2021, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-10-21 03:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-39126

Mitre link : CVE-2021-39126

CVE.ORG link : CVE-2021-39126

JSON object : View

Products Affected

atlassian

  • jira_server
  • jira_data_center
CWE
CWE-352

Cross-Site Request Forgery (CSRF)