CVE-2021-39128: Code Injection
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlassian Jira Server or Data Center (with Jira Service Management addon)to a version that resolves this vulnerability.Fixed in 8.13.12 - Upgrade
Upgrade
Atlassian Jira Server or Data Center (with Jira Service Management addon)to a version that resolves this vulnerability.Fixed in 8.19.1
Event History
Frequently Asked Questions
What is CVE-2021-39128?
CVE-2021-39128 is a server-side template injection vulnerability in the Email Template feature of Atlassian Jira Server or Data Center using the Jira Service Management addon.
How does CVE-2021-39128 affect Atlassian Jira?
CVE-2021-39128 allows remote attackers with JIRA Administrators access to execute arbitrary Java code.
Which versions of Atlassian Jira are affected by CVE-2021-39128?
Affected versions include Atlassian Jira Server 8.13.12 and earlier, Atlassian Jira Server 8.14.0 to 8.19.1, Atlassian Jira Data Center 8.13.12 and earlier, and Atlassian Jira Data Center 8.14.0 to 8.19.1.
What is the severity of CVE-2021-39128?
The severity of CVE-2021-39128 is high, with a CVSS score of 7.2.
How can I fix CVE-2021-39128 in Atlassian Jira?
To fix CVE-2021-39128, it is recommended to upgrade to a version of Atlassian Jira Server or Data Center that is not affected by the vulnerability.