CVE-2021-43947

CVE Database · CVE-2021-43947

CVE-2021-43947

· HIGHModified

CVSS v3.1

7.2

EPSS

4.12%

Published

Jan 5, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products (4)

atlassian · data_center (up to 8.13.15)vulnerable

atlassian · jira (up to 8.13.15)vulnerable

atlassian · jira_data_center (up to 8.20.3)vulnerable

atlassian · jira_server (up to 8.20.3)vulnerable

References (2)

https://jira.atlassian.com/browse/JRASERVER-73067

Issue TrackingVendor Advisory

https://jira.atlassian.com/browse/JRASERVER-73067

Issue TrackingVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs