{"api_version":"1","generated_at":"2026-07-24T02:25:30+00:00","cve":"CVE-2021-26082","urls":{"html":"https://cve.report/CVE-2021-26082","api":"https://cve.report/api/cve/CVE-2021-26082.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-26082","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-26082"},"summary":{"title":"CVE-2021-26082","description":"The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.","state":"PUBLIC","assigner":"security@atlassian.com","published_at":"2021-07-20 04:15:00","updated_at":"2022-03-30 13:29:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72393","name":"https://jira.atlassian.com/browse/JRASERVER-72393","refsource":"MISC","tags":[],"title":"[JRASERVER-72393] Stored XSS on Jira Issue XML Export - CVE-2021-26082 - Create and track feature requests for Atlassian products.","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26082","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26082","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"26082","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26082","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26082","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26082","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-26082","qid":"150381","title":"Atlassian Jira Multiple Vulnerabilities (JULY 2021)"},{"cve":"CVE-2021-26082","qid":"730145","title":"Atlassian Jira Cross Site Scripting Vulnerability (JRASERVER-72393)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2021-07-15T00:00:00","ID":"CVE-2021-26082","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Jira Server","version":{"version_data":[{"version_value":"8.5.14","version_affected":"<"},{"version_value":"8.6.0","version_affected":">="},{"version_value":"8.13.6","version_affected":"<"},{"version_value":"8.14.0","version_affected":">="},{"version_value":"8.17.0","version_affected":"<"}]}},{"product_name":"Jira Data Center","version":{"version_data":[{"version_value":"8.5.14","version_affected":"<"},{"version_value":"8.6.0","version_affected":">="},{"version_value":"8.13.6","version_affected":"<"},{"version_value":"8.14.0","version_affected":">="},{"version_value":"8.17.0","version_affected":"<"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross Site Scripting (XSS)"}]}]},"references":{"reference_data":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72393","refsource":"MISC","name":"https://jira.atlassian.com/browse/JRASERVER-72393"}]}},"nvd":{"publishedDate":"2021-07-20 04:15:00","lastModifiedDate":"2022-03-30 13:29:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*","versionEndExcluding":"8.5.14","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*","versionEndExcluding":"8.5.14","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.0","versionEndExcluding":"8.13.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.17.0","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.0","versionEndExcluding":"8.13.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.17.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"26082","Ordinal":"201027","Title":"CVE-2021-26082","CVE":"CVE-2021-26082","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"26082","Ordinal":"1","NoteData":"The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"26082","Ordinal":"2","NoteData":"2021-07-19","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"26082","Ordinal":"3","NoteData":"2021-07-19","Type":"Other","Title":"Modified"}]}}}