medium5.3Known exploitedPublic exploit code
CVE-2021-26086
Atlassian Jira Server and Data Center Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-11-12. Federal due date: 2024-12-03.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read2021-10-06 · webapps · multiple
Impact
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Jira Data Center | before 8.5.14 from 8.6.0 before 8.13.6 from 8.14.0 before 8.16.1 |
| Atlassian | Jira Server | before 8.5.14 from 8.6.0 before 8.13.6 from 8.14.0 before 8.16.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html
- https://jira.atlassian.com/browse/JRASERVER-72695
- http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html
- https://jira.atlassian.com/browse/JRASERVER-72695
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086