CVE-2021-41308: Atlassian Jira

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the `ReplicationSettings!default.jspa` endpoint. The affected versions are before version 8.6.0, from version 8.7.0 before 8.13.12, and from version 8.14.0 before 8.20.1.

Affected products

• Atlassian Jira: before 8.6.0 (fixed in 8.6.0)
• Atlassian Jira Data Center: from 8.7.0, before 8.13.12 (fixed in 8.13.12)
• Atlassian Jira Server: from 8.7.0, before 8.13.12 (fixed in 8.13.12); from 8.14.0, before 8.20.1 (fixed in 8.20.1)
• Atlassian Jira Software Data Center: before 8.6.0 (fixed in 8.6.0); from 8.14.0, before 8.20.1 (fixed in 8.20.1)

Published 2021-10-26. Last modified 2026-06-17.