Description

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

Remediation

References

CVE-2021-26071

Related Vulnerabilities

Apache Traffic Server Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2023-38522)

Moodle URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-14882)

PHP hangs on parsing particular strings as floating point number

MySQL CVE-2017-3462 Vulnerability (CVE-2017-3462)

WordPress Plugin WooCommerce Upload My File Cross-Site Request Forgery (0.3.9)

Severity

Low

Classification

CVE-2021-26071 CWE-352

Tags

Missing Update Known Vulnerabilities