- Creation
- Validation
- Communication & fix
- Disclosure
fenb.be / Jira vulnerable to CVE-2021-26086
Deleted user
reported 2021-10-23
The instance has been found vulnerable to CVE-2021-26086. And this allows remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. More info here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26086
The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
To fix this, you should update to the most recent version.
IP:
81.246.65.41Port:
443Detected protocol:
httpsVulnerable URL:
https://81.246.65.41/s/lkx/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.propertiesFound pom.properties through CVE-2021-26086:
#Generated by Maven
#Mon Nov 04 08:15:58 UTC 2019
version=8.5.1
groupId=com.atlassian.jira
artifactId=jira-webapp-dist
Found by JiraPlugin 2021-10-15
IP:
81.246.65.41Port:
443Detected protocol:
httpsVulnerable URL:
https://81.246.65.41/s/lkx/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.propertiesFound pom.properties through CVE-2021-26086:
#Generated by Maven
#Mon Nov 04 08:15:58 UTC 2019
version=8.5.1
groupId=com.atlassian.jira
artifactId=jira-webapp-dist
Found by JiraPlugin 2021-11-14
IP:
81.246.65.41Port:
443Detected protocol:
httpsVulnerable URL:
https://81.246.65.41/s/lkx/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.propertiesFound pom.properties through CVE-2021-26086:
#Generated by Maven
#Mon Nov 04 08:15:58 UTC 2019
version=8.5.1
groupId=com.atlassian.jira
artifactId=jira-webapp-dist
Found by JiraPlugin 2021-11-15
Report created by
deleted-user
2021-10-23
deleted-user
2021-10-23
Report edited by
deleted-user
2021-10-23
deleted-user
2021-10-23
Report edited by
BloodyShell
2021-10-23
BloodyShell
2021-10-23
Report approved by
BloodyShell
2021-10-23
BloodyShell
2021-10-23
New PDF report generated by system 2021-10-23
Report dispatched to ...@... by system 2021-10-23
Report dispatched to ...@... by system 2021-10-23
Report comment dispatched to BloodyShell by system 2021-10-26
Report comment dispatched to iampritam by system 2021-10-26
Report comment dispatched to fokoil by system 2021-10-26
system
commented 2021-11-17:
approved
shows in report
bip! I'm a LeakIX probe. This issue looks like it has been resolved!
New PDF report generated by system 2021-11-17
Report comment dispatched to zythop by system 2021-11-17
Report comment dispatched to contact@digitaal.vlaanderen.be by system 2021-11-17
Report comment dispatched to privacy@digitaal.vlaanderen.be by system 2021-11-17
Report marked as fixed by
deleted-user
2022-02-10
deleted-user
2022-02-10
Report closed by
deleted-user
2022-02-10
deleted-user
2022-02-10
New PDF report generated by system 2022-02-10
Report edited by
deleted-user
2022-02-10
deleted-user
2022-02-10
New PDF report generated by system 2022-02-10
Information
Owner
fenb.be
Created
2021-10-23 10:37
Updated
2022-02-22 14:19
Fixed
true
Contacts
c...@digitaal.vlaanderen.be
p...@digitaal.vlaanderen.be
Status
Status
closed
Hosting contacted
false
CERT contacted
false
Download report