CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions from version 1.1.0 before version 2.1.3 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 49.1%

CVSS Severity

CVSS v3 Score 6.5

CVSS v2 Score 4.0

References

Products affected by CVE-2021-26074

Atlassian » Connect Spring Boot » Version: 1.1.0

cpe:2.3:a:atlassian:connect_spring_boot:1.1.0
Atlassian » Connect Spring Boot » Version: 1.2.0

cpe:2.3:a:atlassian:connect_spring_boot:1.2.0
Atlassian » Connect Spring Boot » Version: 1.2.1

cpe:2.3:a:atlassian:connect_spring_boot:1.2.1
Atlassian » Connect Spring Boot » Version: 1.3.0

cpe:2.3:a:atlassian:connect_spring_boot:1.3.0
Atlassian » Connect Spring Boot » Version: 1.3.1

cpe:2.3:a:atlassian:connect_spring_boot:1.3.1
Atlassian » Connect Spring Boot » Version: 1.3.2

cpe:2.3:a:atlassian:connect_spring_boot:1.3.2
Atlassian » Connect Spring Boot » Version: 1.3.3

cpe:2.3:a:atlassian:connect_spring_boot:1.3.3
Atlassian » Connect Spring Boot » Version: 1.3.4

cpe:2.3:a:atlassian:connect_spring_boot:1.3.4
Atlassian » Connect Spring Boot » Version: 1.3.5

cpe:2.3:a:atlassian:connect_spring_boot:1.3.5
Atlassian » Connect Spring Boot » Version: 1.3.6

cpe:2.3:a:atlassian:connect_spring_boot:1.3.6
Atlassian » Connect Spring Boot » Version: 1.4.0

cpe:2.3:a:atlassian:connect_spring_boot:1.4.0
Atlassian » Connect Spring Boot » Version: 1.4.2

cpe:2.3:a:atlassian:connect_spring_boot:1.4.2
Atlassian » Connect Spring Boot » Version: 1.4.3

cpe:2.3:a:atlassian:connect_spring_boot:1.4.3
Atlassian » Connect Spring Boot » Version: 1.5.0

cpe:2.3:a:atlassian:connect_spring_boot:1.5.0
Atlassian » Connect Spring Boot » Version: 1.5.1

cpe:2.3:a:atlassian:connect_spring_boot:1.5.1
Atlassian » Connect Spring Boot » Version: 2.0.0

cpe:2.3:a:atlassian:connect_spring_boot:2.0.0
Atlassian » Connect Spring Boot » Version: 2.0.1

cpe:2.3:a:atlassian:connect_spring_boot:2.0.1
Atlassian » Connect Spring Boot » Version: 2.0.2

cpe:2.3:a:atlassian:connect_spring_boot:2.0.2
Atlassian » Connect Spring Boot » Version: 2.0.3

cpe:2.3:a:atlassian:connect_spring_boot:2.0.3
Atlassian » Connect Spring Boot » Version: 2.0.4

cpe:2.3:a:atlassian:connect_spring_boot:2.0.4
Atlassian » Connect Spring Boot » Version: 2.0.5

cpe:2.3:a:atlassian:connect_spring_boot:2.0.5
Atlassian » Connect Spring Boot » Version: 2.0.6

cpe:2.3:a:atlassian:connect_spring_boot:2.0.6
Atlassian » Connect Spring Boot » Version: 2.0.7

cpe:2.3:a:atlassian:connect_spring_boot:2.0.7
Atlassian » Connect Spring Boot » Version: 2.1.0

cpe:2.3:a:atlassian:connect_spring_boot:2.1.0
Atlassian » Connect Spring Boot » Version: 2.1.1

cpe:2.3:a:atlassian:connect_spring_boot:2.1.1
Atlassian » Connect Spring Boot » Version: 2.1.2

cpe:2.3:a:atlassian:connect_spring_boot:2.1.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-26074

Products

Pricing

Contact Us