CVE-2021-43947

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

CVSS v3 7.2 HIGH
CVSS v2.0 9.0 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://jira.atlassian.com/browse/JRASERVER-73067	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:atlassian:data_center::::::::
	cpe:2.3:a:atlassian:jira::::::::
	cpe:2.3:a:atlassian:jira_data_center::::::::
	cpe:2.3:a:atlassian:jira_server::::::::

History

30 Mar 2022, 13:29

Type	Values Removed	Values Added
First Time		Atlassian jira Data Center
CPE		cpe:2.3:a:atlassian:jira_data_center::::::::

25 Mar 2022, 18:14

Type	Values Removed	Values Added
CPE		cpe:2.3:a:atlassian:jira_server::::::::
First Time		Atlassian jira Server

12 Jan 2022, 20:10

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
References	~~(N/A) https://jira.atlassian.com/browse/JRASERVER-73067 -~~	(N/A) https://jira.atlassian.com/browse/JRASERVER-73067 - Issue Tracking, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 9.0 v3 : 7.2
First Time		Atlassian data Center Atlassian jira Atlassian
CPE		cpe:2.3:a:atlassian:jira:::::::: cpe:2.3:a:atlassian:data_center::::::::

06 Jan 2022, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-01-06 01:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-43947

Mitre link : CVE-2021-43947

CVE.ORG link : CVE-2021-43947

JSON object : View

Products Affected

atlassian

data_center
jira_server
jira_data_center
jira

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-43947", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-01-06T01:15:07.917", "references": [{"url": "https://jira.atlassian.com/browse/JRASERVER-73067", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3."}, {"lang": "es", "value": "Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos con privilegios de administrador ejecutar c\u00f3digo arbitrario por medio de una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota (RCE) en la funcionalidad Email Templates. Este problema evita la correcci\u00f3n de https://jira.atlassian.com/browse/JSDSERVER-8665. Las versiones afectadas son anteriores a versi\u00f3n 8.13.15, y desde versi\u00f3n 8.14.0 hasta 8.20.3."}], "lastModified": "2022-03-30T13:29:49.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CCE06B7-9446-49F4-8B23-4544506E5143", "versionEndExcluding": "8.13.15"}, {"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFC89A4F-566E-4CF3-962C-5F0985A2A9BF", "versionEndExcluding": "8.13.15"}, {"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDD3421F-7C67-4A9E-BAE2-1FD74F921BB9", "versionEndExcluding": "8.20.3", "versionStartIncluding": "8.14.0"}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9025C857-EC16-431D-B3F9-4F10BE17C8A4", "versionEndExcluding": "8.20.3", "versionStartIncluding": "8.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}