{"id":"CVE-2021-41311","aliases":["EUVD-2021-28340","GHSA-7fxq-g996-6g8m"],"status":"published","title":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an...","description":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users \u0026 Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00864,"percentile":0.58882,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2021-12-08T03:35:11Z","modified":"2026-06-17T04:08:17Z","products":[{"vendor":"atlassian","product":"jira data center"},{"vendor":"atlassian","product":"jira server"},{"vendor":"atlassian","product":"jira_data_center"},{"vendor":"atlassian","product":"jira_server"},{"vendor":"atlassian","product":"jira_software_data_center"}],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72802","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41311"},{"url":"https://github.com/advisories/GHSA-7fxq-g996-6g8m"}],"sources":{"cve":[{"id":"CVE-2021-41311","description":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users \u0026 Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.","status":"published","published":"2021-12-08T03:35:11.838Z","modified":"2024-10-10T14:00:43.454Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-28340","description":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users \u0026 Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.","status":"published","published":"2021-12-08T03:35:11Z","modified":"2024-10-10T14:00:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:41.519615Z"}],"ghsa":[{"id":"GHSA-7fxq-g996-6g8m","title":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an...","description":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users \u0026 Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.","status":"published","published":"2021-12-09T00:01:16Z","modified":"2024-10-10T15:30:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:58:28.497096Z"}],"nvd":[{"id":"CVE-2021-41311","description":"Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users \u0026 Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1.","status":"published","published":"2021-12-08T04:15:06.68Z","modified":"2026-06-17T04:08:17.517Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:01.811115Z"}]}}