CVE-2021-26081 — Atlassian Jira Data Center vulnerability

3 documents3 sources

Severity

5.3MEDIUMNVD

EPSS

0.5%

top 33.40%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Jira Data Center Atlassian Jira Server Atlassian Data Center +1 more

Timeline

PublishedJul 20

Latest updateMay 24

Description

REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages6 packages

▶CVEListV5atlassian/jira_data_centerunspecified — 8.5.14+4

▶NVDatlassian/jira_data_center8.6.0 — 8.13.6+1

▶CVEListV5atlassian/jira_serverunspecified — 8.5.14+4

▶NVDatlassian/data_center< 8.5.14

▶NVDatlassian/jira_server8.6.0 — 8.13.6+1

Patches

Patch: jira.atlassian.com ↗Patch: jira.atlassian.com ↗

🔴Vulnerability Details

GHSA

GHSA-v3g7-jggh-wjhg: REST API in Atlassian Jira Server and Jira Data Center before version 8↗2022-05-24

▶

CVEList

CVE-2021-26081: REST API in Atlassian Jira Server and Jira Data Center before version 8↗2021-07-20

▶