PT-2021-16935 · Atlassian · Jira

Muhamad Visat · Published 2021-02-18 · Updated 2022-02-17 · CVE-2021-26068

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server for Slack plugin versions 0.0.3 through 2.0.14

Description The issue allows remote attackers to execute arbitrary code via a template injection vulnerability in an endpoint.

Recommendations For Atlassian Jira Server for Slack plugin versions 0.0.3 through 2.0.14, update to version 2.0.15 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-26068

Affected Products

Jira

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-26068 · Security Note
• https://confluence.atlassian.com/jira/jira-server-for-slack-security-advisory-17th-february-2021-1044091690.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26068 · Vendor Advisory
• https://t.me/cibsecurity/23957 · Telegram Post