CVE-2021-26080

MEDIUM

Jira Server and Data Center < 8.5.14, 8.6.0-8.13.6, 8.14.0-8.16.1 - Cross-Site Scripting in EditworkflowScheme.jspa

Title source: llm

Description

EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_misc

https://jira.atlassian.com/browse/JRASERVER-72432

Scores

CVSS v3 6.1

EPSS 0.0057

EPSS Percentile 68.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

atlassian/jira_data_center < 8.5.14

atlassian/jira_server < 8.5.14

Published Jun 07, 2021

Tracked Since Feb 18, 2026