CVE-2021-26076

The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4…

published April 14, 2021

CVSS
—
EPSS
1%
Percentile
68.8
In the wild
Unconfirmed
What it is

The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01232 · 68.8th percentile
Published
2021-04-14T23:45Z
EPSS history
Timeline
  • 14 APR 23:45Z
    The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4…
    cvelistv5