Broken Access Control in Atlassian Jira Server and Data Center allows unauthorized issue notifications
CVE-2021-39119 · MEDIUM Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0.
Learn more about our Cis Benchmark Audit For Server Software.