3.5
CVE-2021-26071
- EPSS 0.16%
- Veröffentlicht 01.04.2021 03:15:14
- Zuletzt bearbeitet 21.11.2024 05:55:48
- Quelle security@atlassian.com
- CVE-Watchlists
- Unerledigt
LoginThe SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atlassian ≫ Data Center Version < 8.5.13
Atlassian ≫ Jira Data Center Version >= 8.6.0 < 8.13.5
Atlassian ≫ Jira Data Center Version >= 8.14.0 < 8.15.1
Atlassian ≫ Jira Server Version >= 8.6.0 < 8.13.5
Atlassian ≫ Jira Server Version >= 8.14.0 < 8.15.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.371 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 3.5 | 2.1 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
|
| nvd@nist.gov | 3.5 | 6.8 | 2.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.