CVE-2021-39115

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

Affected

Atlassian · Jira Service Desk Server · Jira Service Desk Data Center

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

4.48% chance of exploitation in the next 30 days, 91st percentile

Published

2021-09-01

Updated

2024-10-11

Proof-of-concept exploits (1)

• PetrusViet/CVE-2021-3911548★ · 2021-09-09

Security advisories

• https://jira.atlassian.com/browse/JSDSERVER-8665

References

• CVE Record
• NVD entry

Related

• CVE-2019-11581
• CVE-2019-3396
• CVE-2022-22965
• CVE-2023-38743