HIGH🇵🇱 Wersja polska

CVE-2021-39115

CVSS 7.2v3.1pub. 2021-09-01upd. 2024-11-21

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Atlassian Jira Service Desk

    APP
    Atlassian
    < 4.13.9

  • Atlassian Jira Service Management

    APP
    Atlassian
    4.14.0 – 4.18.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-22501CRITICAL9.1PL ✓same product

Atlassian Jira Service Management — ominięcie uwierzytelnienia (Auth Bypass)

CVE-2022-26136CRITICAL9.8PL ✓same product

Atlassian — pominięcie Servlet Filters umożliwia auth bypass i XSS

CVE-2022-0540CRITICAL9.8PL ✓same product

Atlassian Jira Seraph – Auth Bypass przez spreparowane żądanie HTTP

CVE-2020-36239CRITICAL9.8PL ✓same product

Atlassian Jira Data Center — RCE przez brak uwierzytelnienia w Ehcache RMI

CVE-2019-13990CRITICAL9.8PL ✓same product

XXE w Terracotta Quartz Scheduler — atak przez opis zadania XML