CVE-2021-41311CWE-287

Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify…

High · published December 8, 2021

CVSS v3.1
7.5
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00864 · 58.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2021-12-08T03:35Z
EPSS history
Timeline
  • 08 DEC 03:35Z
    Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify…
    cvelistv5