[JSDSERVER-8665] Template Injection in Email Templates leads to code execution on Jira Service Management Server - CVE-2021-39115 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Public Security Vulnerability
Status: Published (View Workflow)
Priority: Low
Resolution: Fixed
Affects Version/s: 4.17.1, 4.13.8, 4.5.18
Fix Version/s: 4.18.0, 4.13.9
Component/s: None
Labels:

CVSS Score:
7.2
CVSS Severity:
High
CVE ID:
CVE-2021-39115

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature.

The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

Affected versions:

version < 4.13.9
4.14.0 ≤ version < 4.18.0

Fixed versions:

4.13.9
4.18.0

Attachments

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 7 Start watching this issue

Dates

Created:: 25/Aug/2021 4:24 AM

Updated:: 14/Feb/2022 9:27 PM

Resolved:: 01/Sep/2021 10:58 PM