CVE-2021-41308

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-26 · updated 2026-06-17
Weakness: CWE-285

Description

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.

Affected products

Atlassian Jira: before 8.6.0 — fixed in 8.6.0
Atlassian Jira: from 8.7.0 before 8.13.12 — fixed in 8.13.12
Atlassian Jira: from 8.7.0 before 8.13.12; from 8.14.0 before 8.20.1 — fixed in 8.13.12, 8.20.1
Atlassian Jira Software Data Center: before 8.6.0; from 8.14.0 before 8.20.1 — fixed in 8.20.1, 8.6.0

How to fix

Upgrade to a fixed version: Atlassian Jira 8.6.0; Atlassian Jira 8.13.12; Atlassian Jira 8.13.12, 8.20.1; Atlassian Jira Software Data Center 8.20.1, 8.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41308 or the next vulnerability affects your stack