CVE-2021-39124

4.3 MEDIUM

The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote ...

Published: 2021-09-14 · Last updated: 2026-06-17

Severity and scoring

CVSS: 4.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE: CWE-352

Affected products

Vendor	Product
atlassian	data_center, jira

Description

The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a crafted request.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-39124
[Vendor advisory]https://jira.atlassian.com/browse/JRASERVER-72761
[Vendor advisory]https://jira.atlassian.com/browse/JRASERVER-72761

Related CVEs

Same vendor

CVE-2021-41312 — Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Man... (7.5 HIGH)
CVE-2021-41310 — Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a ... (6.1 MEDIUM)
CVE-2021-41313 — Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configu... (4.3 MEDIUM)
CVE-2021-41308 — Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Re... (6.5 MEDIUM)
CVE-2021-41307 — Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects a... (7.5 HIGH)

Same CWE

CVE-2026-49043 — Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions (4.7 MEDIUM)
CVE-2026-48518 — MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances (4.3 MEDIUM)
CVE-2016-20083 — WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized action... (5.3 MEDIUM)
CVE-2016-20074 — WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorize... (4.3 MEDIUM)
CVE-2016-20067 — WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on beh... (4.3 MEDIUM)