medium6.1Public exploit code
CVE-2021-26078
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)2021-06-28 · webapps · macos
Impact
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Data Center | before 8.5.14 from 8.6.0 before 8.13.6 from 8.14.0 before 8.16.1 |
| Atlassian | Jira | before 8.5.14 |
| Atlassian | Jira Server | from 8.6.0 before 8.13.6 from 8.14.0 before 8.16.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.html
- https://jira.atlassian.com/browse/JRASERVER-72392
- http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.html
- https://jira.atlassian.com/browse/JRASERVER-72392