CVE-2021-43942

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting…

published January 4, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
55%
Percentile
99.0
In the wild
Unconfirmed
What it is

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.55364 · 99.0th percentile
Published
2022-01-04T02:40Z
EPSS history
Timeline
  • 04 JAN 02:40Z
    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting…
    cvelistv5