VULNERABILITY INTELLIGENCE

CVE-2021-39115

CVSS score7.2 HIGH
EPSS probability4.48%
CISA KEVNot currently listed
Published2021-09-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

Weakness classification

  • security@atlassian.com: CWE-96
  • nvd@nist.gov: CWE-94

Primary references