Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.10 or 8.6.x prior to 8.13.1. It is, therefore, affected by a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira installed on the remote host is prior to < 8.5.10 / 8.6.x < 8.13.1. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-71806 advisory.

  - CSRF token theft through referrer headers - CVE-2021-39126 (CVE-2021-39126)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113285	Atlassian Jira 8.6.x < 8.13.1 Cross-Site Request Forgery	Web App Scanning	Component Vulnerability	medium
113284	Atlassian Jira < 8.5.10 Cross-Site Request Forgery	Web App Scanning	Component Vulnerability	medium
162755	Atlassian Jira < 8.5.10 / 8.6.x < 8.13.1 XSRF (JRASERVER-71806)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2021-39126

medium

Tenable Plugins

medium

medium

medium