Medium severity6.1NVD Advisory· Published Oct 26, 2021· Updated Jun 17, 2026
CVE-2021-41304
CVE-2021-41304
Description
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7- Range: <8.13.12, >=8.14.0,<8.20.2
unspecified+ 1 more
- (no CPE)range: unspecified
- cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*range: >=8.14.0,<8.20.2
- Range: unspecified
- cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*Range: >=8.14.0,<8.20.2
Patches
Vulnerability mechanics
References
1- jira.atlassian.com/browse/JRASERVER-72939nvdIssue TrackingPatchVendor Advisory
News mentions
0No linked articles in our index yet.