CVE-2021-26078
CVE-2021-26078
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 3.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
07 Jun 2021Published on NVD
28 Jun 2021Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50068unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →