CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
References
Link Resource
https://jira.atlassian.com/browse/JRASERVER-73072 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*

History

13 Jun 2022, 16:21

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
First Time Atlassian jira Data Center

25 Mar 2022, 18:14

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
First Time Atlassian jira Server

14 Mar 2022, 13:13

Type Values Removed Values Added
References (N/A) https://jira.atlassian.com/browse/JRASERVER-73072 - (N/A) https://jira.atlassian.com/browse/JRASERVER-73072 - Issue Tracking, Vendor Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 6.5
v3 : 7.2
CWE CWE-94
CPE cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*
First Time Atlassian jira
Atlassian jira Software Data Center
Atlassian

08 Mar 2022, 02:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-03-08 02:15

Updated : 2023-12-10 14:22


NVD link : CVE-2021-43944

Mitre link : CVE-2021-43944

CVE.ORG link : CVE-2021-43944


JSON object : View

Products Affected

atlassian

  • jira_server
  • jira_data_center
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')