Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.9 or 8.14.x prior to 8.18.0. It is, therefore, affected by a broken access control vulnerability in the allowlist feature allowing anonymous remote attackers to continue to view cached content even after losing permissions.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
112951	Atlassian Jira 8.14.x < 8.18.0 Broken Access Control	Web App Scanning	Component Vulnerability	Version Based	high
112950	Atlassian Jira < 8.13.9 Broken Access Control	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2021-39113

high

Tenable Plugins

high

high