CVE-2021-26078

The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

Affected

Atlassian · Jira Server · Jira Data Center

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.03% chance of exploitation in the next 30 days, 90th percentile

Published

2021-06-07

Updated

2024-10-17

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cros…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50068

Security advisories

• https://jira.atlassian.com/browse/JRASERVER-72392

References

• CVE Record
• NVD entry