HIGH🇵🇱 Wersja polska

CVE-2021-43947

CVSS 7.2v3.1pub. 2022-01-06upd. 2024-11-21

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Atlassian Data Center

    APP
    Atlassian
    < 8.13.15

  • Atlassian Jira

    APP
    Atlassian
    < 8.13.15

  • Atlassian Jira Data Center

    APP
    Atlassian
    8.14.0 – 8.20.3 (bez)

  • Atlassian Jira Server

    APP
    Atlassian
    8.14.0 – 8.20.3 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2019-11581CRITICAL9.8⚠ KEVten sam produkt

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdminis...

CVE-2022-26136CRITICAL9.8ten sam produkt

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Fil...

CVE-2022-0540CRITICAL9.8ten sam produkt

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a...

CVE-2020-36239CRITICAL9.8ten sam produkt

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6....

CVE-2020-14172CRITICAL9.8ten sam produkt

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velo...