CVE-2021-41308

Summary

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the ReplicationSettings!default.jspa endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.

Affected Software

VendorProductVersion RangeStatus
AtlassianJira Serverunspecified < 8.6.0affected
AtlassianJira Server8.7.0 < unspecifiedaffected
AtlassianJira Serverunspecified < 8.13.12affected
AtlassianJira Server8.14.0 < unspecifiedaffected
AtlassianJira Serverunspecified < 8.20.1affected
AtlassianJira Data Centerunspecified < 8.6.0affected
AtlassianJira Data Center8.7.0 < unspecifiedaffected
AtlassianJira Data Centerunspecified < 8.13.12affected
AtlassianJira Data Center8.14.0 < unspecifiedaffected
AtlassianJira Data Centerunspecified < 8.20.1affected

Weaknesses

  • CWE-285: Improper Authorization (CWE-285)

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References