CVE-2021-26078 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the number range searcher component in Atlassian Jira Server and Jira Data Center across multiple versions. This flaw allows remote attackers to inject arbitrary HTML or JavaScript. Rated as Medium severity (CVSS 6.1), it requires user interaction (UI:R) but has low attack complexity (AC:L) and can lead to limited impact on confidentiality and integrity. While not listed in CISA's KEV catalog, an ExploitDB entry (EDB-50068) confirms the availability of exploit code, though there is no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 8.5.14CPE matchmatch criteria | cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* | ||
>= 8.6.0, < 8.13.6CPE matchmatch criteria | cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* | ||
>= 8.14.0, < 8.16.1CPE matchmatch criteria | cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* | ||
< 8.5.14CPE matchmatch criteria | cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* | ||
>= 8.6.0, < 8.13.6CPE matchmatch criteria | cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.