CVE-2021-39128
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Atlassian | Jira Server | unspecified < 8.13.12 | affected |
| Atlassian | Jira Server | 8.14.0 < unspecified | affected |
| Atlassian | Jira Server | unspecified < 8.19.1 | affected |
| Atlassian | Jira Data Center | unspecified < 8.13.12 | affected |
| Atlassian | Jira Data Center | 8.14.0 < unspecified | affected |
| Atlassian | Jira Data Center | unspecified < 8.19.1 | affected |
Weaknesses
- CWE-1336: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.