#VU57963 Improper Authorization in Jira Software - CVE-2021-41312

Vulnerability identifier: #VU57963

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-41312

CWE-ID: CWE-285

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jira Software
Client/Desktop applications / Other client software

Vendor: Atlassian

Description

The vulnerability allows a remote user to bypass authorization process.

The vulnerability exists due to an error in when processing requests in the /secure/ViewCollectors endpoint. A remote user with revoked access from the Jira Service Management can enable and disable Issue Collectors on Jira Service Management projects.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Jira Software: 8.19.0

---

External links
https://jira.atlassian.com/browse/JRASERVER-72801

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.