Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.3 or 8.14.x < 8.14.1. It is, therefore, affected by a broken authentication vulnerability in the makeRequest gadget resource allowing remote attackers to evade behind-the-firewall protection of app-linked resources.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is affected by a broken authentication vulnerability in the makeRequest gadget resource. An unauthenticated, remote attacker can exploit this issue to evade behind-the-firewall protection of app-linked resources.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

ID	Name	Product	Family	Severity
112837	Atlassian Jira 8.14.x < 8.14.1 Broken Authentication	Web App Scanning	Component Vulnerability	high
112836	Atlassian Jira < 8.13.3 Broken Authentication	Web App Scanning	Component Vulnerability	high
148265	Atlassian Jira < 8.13.3 / 8.14.x < 8.14.1 Broken Authentication (JRASERVER-72029)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2021-26070

high

Tenable Plugins

high

high

high