6.5

CVE-2021-41308

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atlassian ≫ Jira Version < 8.6.0
Atlassian ≫ Jira Data Center Version >= 8.7.0 < 8.13.12
Atlassian ≫ Jira Server Version >= 8.7.0 < 8.13.12
Atlassian ≫ Jira Server Version >= 8.14.0 < 8.20.1
Atlassian ≫ Jira Software Data Center Version >= 8.14.0 < 8.20.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.474
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

https://jira.atlassian.com/browse/JRASERVER-72940
Patch
Vendor Advisory
Issue Tracking