{"api_version":"1","generated_at":"2026-07-23T19:39:22+00:00","cve":"CVE-2021-26083","urls":{"html":"https://cve.report/CVE-2021-26083","api":"https://cve.report/api/cve/CVE-2021-26083.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-26083","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-26083"},"summary":{"title":"CVE-2021-26083","description":"Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.","state":"PUBLIC","assigner":"security@atlassian.com","published_at":"2021-07-20 04:15:00","updated_at":"2022-03-30 13:29:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72213","name":"https://jira.atlassian.com/browse/JRASERVER-72213","refsource":"MISC","tags":[],"title":"[JRASERVER-72213] The name of a filter can be used to XSS users who open an \"Export HTML Report\" - CVE-2021-26083 - Create and track feature requests for Atlassian products.","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26083","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26083","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"26083","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26083","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26083","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_data_center","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"26083","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"atlassian","cpe5":"jira_server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-26083","qid":"150381","title":"Atlassian Jira Multiple Vulnerabilities (JULY 2021)"},{"cve":"CVE-2021-26083","qid":"730144","title":"Atlassian Jira Multiple Vulnerabilities (JRASERVER-72213, JRASERVER-72499)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@atlassian.com","DATE_PUBLIC":"2021-07-15T00:00:00","ID":"CVE-2021-26083","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Jira Server","version":{"version_data":[{"version_value":"8.5.14","version_affected":"<"},{"version_value":"8.6.0","version_affected":">="},{"version_value":"8.13.6","version_affected":"<"},{"version_value":"8.14.0","version_affected":">="},{"version_value":"8.16.1","version_affected":"<"}]}},{"product_name":"Jira Data Center","version":{"version_data":[{"version_value":"8.5.14","version_affected":"<"},{"version_value":"8.6.0","version_affected":">="},{"version_value":"8.13.6","version_affected":"<"},{"version_value":"8.14.0","version_affected":">="},{"version_value":"8.16.1","version_affected":"<"}]}}]},"vendor_name":"Atlassian"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross Site Scripting (XSS)"}]}]},"references":{"reference_data":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72213","refsource":"MISC","name":"https://jira.atlassian.com/browse/JRASERVER-72213"}]}},"nvd":{"publishedDate":"2021-07-20 04:15:00","lastModifiedDate":"2022-03-30 13:29:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*","versionEndExcluding":"8.5.14","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*","versionEndExcluding":"8.5.14","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.0","versionEndExcluding":"8.13.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.16.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.0","versionEndExcluding":"8.13.6","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"8.14.0","versionEndExcluding":"8.16.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"26083","Ordinal":"201028","Title":"CVE-2021-26083","CVE":"CVE-2021-26083","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"26083","Ordinal":"1","NoteData":"Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"26083","Ordinal":"2","NoteData":"2021-07-19","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"26083","Ordinal":"3","NoteData":"2021-07-19","Type":"Other","Title":"Modified"}]}}}