« Volver al listado

CVE-2021-43946

Estado: ModificadaMedia (6.5)—

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Atlassian — Jira Data CenterAtlassian — Jira Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-43946",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-43946",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-08T14:23:52.557550Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@atlassian.com",
      "affectedData": [
        {
          "vendor": "Atlassian",
          "product": "Jira Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.13.21",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.14.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.20.9",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Atlassian",
          "product": "Jira Data Center",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.13.21",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.14.0",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "8.20.9",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-05T04:15:07.497",
  "references": [
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-73071",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@atlassian.com"
    },
    {
      "url": "https://jira.atlassian.com/browse/JRASERVER-73071",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9."
    },
    {
      "lang": "es",
      "value": "Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos autenticados añadir grupos de administradores para filtrar suscripciones a través de una vulnerabilidad de control de acceso rota en el endpoint /secure/EditSubscription.jspa. Las versiones afectadas son anteriores a la versión 8.13.21, y desde la versión 8.14.0 hasta la 8.20.9"
    }
  ],
  "lastModified": "2026-06-17T04:11:40.723",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6E2D8D4-8FD6-41DF-9B2F-1D5444D0D98A",
              "versionEndExcluding": "8.13.21"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C46688B0-2FD1-4C85-B255-E80B005F8460",
              "versionEndExcluding": "8.20.9",
              "versionStartIncluding": "8.14.0"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28245007-F700-4D8E-B3B6-C625B66C580C",
              "versionEndExcluding": "8.13.21"
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17F39957-F0F0-4FFD-9E2E-12578FA6B918",
              "versionEndExcluding": "8.20.9",
              "versionStartIncluding": "8.14.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@atlassian.com"
}