Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-26076

The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.

Published

2021-04-15T00:15:12.983

Last Modified

2024-11-21T05:55:49.403

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application atlassian data_center < 8.5.12 Yes
Application atlassian jira < 8.5.12 Yes
Application atlassian jira_data_center < 8.13.4 Yes
Application atlassian jira_data_center < 8.15.1 Yes
Application atlassian jira_server < 8.13.4 Yes
Application atlassian jira_server < 8.15.1 Yes
References