Skip to content
OpenAdvisories
Unscored CVE-2021-26070 EUVD-2021-12893GHSA-3q2j-hfh6-wm75

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked res…

Published Mar 22, 2021 · Updated Sep 16, 2024 · Assigned by atlassian

Vendor: Atlassian Product: Jira Data Center Product: Jira Server Category: Web / CMS

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

Affected products

VendorProductAffectedFixed
Atlassian Jira Server unspecified – < 8.13.3, 8.14.0 – < unspecified, unspecified – < 8.14.1 8.13.3
Atlassian Jira Data Center unspecified – < 8.13.3, 8.14.0 – < unspecified, unspecified – < 8.14.1 8.13.3

References