What is CVE-2021-26074?

CVE-2021-26074 is a medium-severity vulnerability in Atlassian Connect Spring Boot (Acsb), classified under Improper Authentication. CVSS score: 6.5/10. Published 2021-04-16.

How severe is CVE-2021-26074?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Atlassian Connect Spring Boot (Acsb)

CVE-2021-26074

Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions from version 1.1.0 before version 2.1.3 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.

Vulnerability class: Broken Authentication

EPSS: 0.007 (47.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Atlassian Connect Spring Boot (Acsb) — versions 1.1.0, unspecified
Atlassian Connect_spring_boot

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security@atlassian.com (x_refsource_MISC, Vendor Advisory)
security@atlassian.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-26074?: CVE-2021-26074 is a medium-severity vulnerability in Atlassian Connect Spring Boot (Acsb), classified under Improper Authentication. CVSS score: 6.5/10. Published 2021-04-16.
How severe is CVE-2021-26074?: Medium severity. CVSS v3 base score is 6.5 out of 10.