CVE-2021-39115: Code Injection
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a ServerSide Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlassian Jira Service Management Server and Data Centerto a version that resolves this vulnerability.Fixed in 4.13.9 - Upgrade
Upgrade
Atlassian Jira Service Management Server and Data Centerto a version that resolves this vulnerability.Fixed in 4.18.0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39115?
The severity of CVE-2021-39115 is critical.
What is the vulnerability in Atlassian Jira Service Management?
The vulnerability in Atlassian Jira Service Management is a Server_Side Template Injection vulnerability in the Email Template feature.
Which versions of Atlassian Jira Service Management are affected?
Versions up to and excluding 4.13.9 in Data Center and versions 4.14.0 to 4.18.0 in Server of Atlassian Jira Service Management are affected.
How can remote attackers exploit CVE-2021-39115?
Remote attackers with "Jira Administrators" access can exploit CVE-2021-39115 to execute arbitrary Java code or run arbitrary system commands.
How can I fix CVE-2021-39115 in Atlassian Jira Service Management?
To fix CVE-2021-39115 in Atlassian Jira Service Management, update to a version beyond 4.13.9 in Data Center or a version beyond 4.18.0 in Server.