CVE-2021-43959

Summary

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.

Affected Software

VendorProductVersion RangeStatus
AtlassianJira Service Management Serverunspecified < 4.13.20affected
AtlassianJira Service Management Server4.14.0 < unspecifiedaffected
AtlassianJira Service Management Serverunspecified < 4.20.8affected
AtlassianJira Service Management Server4.21.0 < unspecifiedaffected
AtlassianJira Service Management Serverunspecified < 4.22.2affected
AtlassianJira Service Management Data Centerunspecified < 4.13.20affected
AtlassianJira Service Management Data Center4.14.0 < unspecifiedaffected
AtlassianJira Service Management Data Centerunspecified < 4.20.8affected
AtlassianJira Service Management Data Center4.21.0 < unspecifiedaffected
AtlassianJira Service Management Data Centerunspecified < 4.22.2affected

Weaknesses

  • Server-Side Request Forgery

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References