CVE-2021-39115CWE-96

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary…

High · published September 1, 2021

CVSS v3.1
7.2
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04483 · 91.4th percentile
Weakness
CWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Published
2021-09-01T23:00Z
EPSS history
Timeline
  • 01 SEP 23:00Z
    Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary…
    cvelistv5