CVE-2021-26071

LOW

Jira Server/Data Center <8.5.13, 8.6.0-8.13.5 - CSRF via SetFeatureEnabled.jspa

Title source: llm
STIX 2.1

Description

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_misc
https://jira.atlassian.com/browse/JRASERVER-72233

Scores

CVSS v3 3.5
EPSS 0.0011
EPSS Percentile 29.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-352
Status published
Products (4)
atlassian/data_center < 8.5.13
atlassian/jira < 8.5.13
atlassian/jira_data_center 8.6.0 - 8.13.5
atlassian/jira_server 8.6.0 - 8.13.5
Published Apr 01, 2021
Tracked Since Feb 18, 2026