CVE-2021-26086

Atlassian Jira Server and Data Center Path Traversal Vulnerability

Atlassian — Jira Server and Data Center

Added to KEV catalog: 12 November 2024
Federal remediation due date: 3 December 2024
Weakness classification (CWE): CWE-22

CISA Description

Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://jira.atlassian.com/browse/JRASERVER-72695 ; https://nvd.nist.gov/vuln/detail/CVE-2021-26086

View on NVD View on MITRE CVE View full CISA catalog

More Atlassian Vulnerabilities

CVE-2023-22527

Atlassian Confluence Data Center and Server Template Injection Vulnerability

CVE-2023-22518

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

CVE-2023-22515

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

CVE-2022-36804

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

CVE-2022-26138

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services