CVE-2021-41304

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
AtlassianJira Server>= unspecified, < 8.13.12; >= 8.14.0, < unspecified; >= unspecified, < 8.20.2
AtlassianJira Data Center>= unspecified, < 8.13.12; >= 8.14.0, < unspecified; >= unspecified, < 8.20.2

References

Timeline

Published
Oct 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-413057.5Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filterCVE-2021-413067.5Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an CVE-2021-413077.5Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and CVE-2021-413086.5Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File RepliCVE-2021-413095.3Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export aCVE-2021-41318.8livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-413106.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroCVE-2021-413117.5Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access rCVE-2021-413127.5Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service ManageCVE-2021-413134.3Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configuratCVE-2021-413148.8Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the aCVE-2021-413158.8The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated at
CVE-2021-41304: Medium severity, CVSS 6.1 | Vulnix