CVE-2021-39121

3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 53.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Atlassian Jira Data CenterAtlassian Jira ServerAtlassian Data Center+1 more
Timeline
PublishedSep 8
Latest updateMay 24

Description

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages6 packages

▶CVEListV5atlassian/jira_data_centerunspecified — 8.5.18+4
▶NVDatlassian/jira_data_center8.6.0 — 8.13.10+1
▶CVEListV5atlassian/jira_serverunspecified — 8.5.18+4
▶NVDatlassian/jira_server8.6.0 — 8.13.10+1
▶NVDatlassian/jira< 8.5.18

Patches

Patch: jira.atlassian.com ↗Patch: jira.atlassian.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-r34f-76fq-39vg: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an↗2022-05-24
▶
CVEList
CVE-2021-39121: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an↗2021-09-08
▶
CVE-2021-39121 (MEDIUM CVSS 4.3) | Affected versions of Atlassian Jira | cvebase.io