Description

Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0.

Remediation

References

CVE-2021-39119

Related Vulnerabilities

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-1500)

WordPress Plugin WordPress.com Custom CSS Cross-Site Scripting (1.5)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3369)

Sqlite CVE-2019-19603 Vulnerability (CVE-2019-19603)

WordPress Plugin WordPress Infinite Scroll-Ajax Load More Unspecified Vulnerability (2.11.0)

Severity

Medium

Classification

CVE-2021-39119 CWE-287

Tags

Missing Update Known Vulnerabilities