QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-26076

Back to search

CVE-2021-26076

Published: Apr 14, 2021

Modified: Oct 17, 2024

PUBLISHED

Description

The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.

VendorProductVersions

Atlassian

Jira Server

affected
unspecified - < 8.5.12
affected
8.6.0 - < unspecified
affected
unspecified - < 8.13.4
affected
8.14.0 - < unspecified
affected
unspecified - < 8.15.0

Atlassian

Jira Data Center

affected
unspecified - < 8.5.12
affected
8.6.0 - < unspecified
affected
unspecified - < 8.13.4
affected
8.14.0 - < unspecified
affected
unspecified - < 8.15.0

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now