CVE-2021-43947

7.2HIGH

Key Information:

Vendor
Atlassian
Status
Jira Server
Jira Data Center
Vendor
CVE Published:
6 January 2022

Summary

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

Affected Version(s)

Jira Data Center < 8.13.15

Jira Data Center 8.14.0

Jira Data Center < 8.20.3

References

https://jira.atlassian.com/browse/JRASERVER-73067
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.