Description

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability.

Remediation

References

CVE-2021-26071

Related Vulnerabilities

WordPress Plugin WP Flash Player Multiple Cross-Site Scripting Vulnerabilities (1.3)

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-5191)

WordPress Plugin Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages Multiple Cross-Site Scripting Vulnerabilities (45.0)

WordPress Plugin Add Custom Link to WordPress Admin Bar Cross-Site Scripting (1.0)

Ruby on Rails Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-8167)

Severity

Low

Classification

CVE-2021-26071 CWE-352

Tags

Missing Update Known Vulnerabilities