Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-26075

The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an information disclosure vulnerability in the error message when presented with an invalid filename.

Published

2021-04-15T00:15:12.920

Last Modified

2024-11-21T05:55:49.273

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application atlassian data_center < 8.5.12 Yes
Application atlassian jira < 8.5.12 Yes
Application atlassian jira_data_center < 8.13.4 Yes
Application atlassian jira_data_center < 8.15.1 Yes
Application atlassian jira_server < 8.13.4 Yes
Application atlassian jira_server < 8.15.1 Yes
References