CVE-2021-26078

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Jira Server	>= unspecified, < 8.5.14; >= 8.6.0, < unspecified; >= unspecified, < 8.13.6; >= 8.14.0, < unspecified; >= unspecified, < 8.16.1
Atlassian	Jira Data Center	>= unspecified, < 8.5.14; >= 8.6.0, < unspecified; >= unspecified, < 8.13.6; >= 8.14.0, < unspecified; >= unspecified, < 8.16.1

References

http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-72392Patch, Vendor Advisory
http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-72392Patch, Vendor Advisory

Timeline

Published: Jun 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-260796.1The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7,CVE-2021-260806.1EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.CVE-2021-260815.3REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 befo CVE-2021-260825.4The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.CVE-2021-260835.4Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8 CVE-2021-260849.8In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack CVE-2021-260855.3Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File CVE-2021-260865.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit CVE-2021-260876.1An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, CVE-2021-260889.6An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO fire CVE-2021-260897.8An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell CVE-2021-260907.5A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2