PT-2021-23266 · Atlassian · Jira

Published 2021-12-08 · Updated 2024-10-10 · CVE-2021-41311

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.19.1

Description The issue allows attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings. This is achieved through a Broken Authentication vulnerability in the "/plugins/servlet/project-config/PROJECT/roles" endpoint.

Recommendations For versions prior to 8.19.1, update to version 8.19.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/plugins/servlet/project-config/PROJECT/roles" endpoint until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-41311

Affected Products

Jira

References · 4

• https://osv.dev/vulnerability/CVE-2021-41311 · Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-72802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41311 · Security Note
• https://t.me/cvenotify/24391 · Telegram Post