CVE-2021-26079

MEDIUM

Jira Server and Data Center < 8.5.15 and 8.6.0-8.13.7 - Cross-Site Scripting in CardLayoutConfigTable

Title source: llm

Description

The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

References (1)

Core 1

Core References

Issue Tracking, Patch, Vendor Advisory x_refsource_misc

https://jira.atlassian.com/browse/JRASERVER-72396

Scores

CVSS v3 6.1

EPSS 0.0066

EPSS Percentile 71.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (4)

atlassian/data_center < 8.5.15

atlassian/jira < 8.5.15

atlassian/jira_data_center 8.6.0 - 8.13.7

atlassian/jira_server 8.6.0 - 8.13.7

Published Jun 07, 2021

Tracked Since Feb 18, 2026