CVE-2021-26070: 
JIRA vulnerability analysis and mitigation

Affected versions of Atlassian Jira Server and Data Center contain a Broken Authentication vulnerability (CVE-2021-26070) in the makeRequest gadget resource. The vulnerability affects versions before 8.13.3 and versions 8.14.0 before 8.14.1, allowing remote attackers to evade behind-the-firewall protection of app-linked resources (Jira Server).

The vulnerability exists in the makeRequest gadget resource functionality of Jira Server and Data Center. The flaw allows attackers to bypass authentication mechanisms designed to protect app-linked resources that are supposed to be behind the firewall. The vulnerability has been assigned a CVSS score of 6.4, indicating a medium severity level (NVD).

The vulnerability enables remote attackers to access resources that should be protected by the firewall, potentially exposing sensitive information or functionality that was intended to be restricted (Jira Server).

The vulnerability can be exploited by remote attackers without requiring authentication, making it particularly concerning for exposed Jira instances (Jira Server).

Atlassian has released fixed versions to address this vulnerability. Users should upgrade to version 8.13.3, 8.14.1, or 8.15.0 to resolve the issue. No workarounds are available for this vulnerability (Jira Server).