Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

The Atlassian JIRA application running on the remote host is < 8.5.14, 8.6.0 < 8.13.6 or 8.14.0 < 8.16.1.
It is ,therefore, affected by a path traversal vulnerability affecting the /WEB-INF/web.xml endpoint. Attackers can exploit this vulnerability to read particular files.

The version of Atlassian Jira installed on the remote host is prior to < 8.5.14 / 8.6.x < 8.13.6 / 8.14.x < 8.16.1 / 8.17.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72695 advisory.

  - Limited Remote File Read in Jira Software Server - CVE-2021-26086 (CVE-2021-26086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.14, 8.6.x < 8.13.6 or 8.14.x < 8.16.1. It is, therefore, affected by a path traversal vulnerability in the /WEB-INF/web.xml endpoint allowing remote attackers to read particular files.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
187096	Jira Server/Data Center Limited Remote File Read (CVE-2021-26086)	Nessus	Web Servers	medium
162761	Atlassian Jira < 8.5.14 / 8.6.x < 8.13.6 / 8.14.x < 8.16.1 / 8.17.0 (JRASERVER-72695)	Nessus	CGI abuses	medium
112956	Atlassian Jira 8.14.x < 8.16.1 Arbitrary File Read	Web App Scanning	Component Vulnerability	medium
112955	Atlassian Jira 8.6.x < 8.13.6 Arbitrary File Read	Web App Scanning	Component Vulnerability	medium
112954	Atlassian Jira < 8.5.14 Arbitrary File Read	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2021-26086

medium

Tenable Plugins

medium

medium

medium

medium

medium