CVE-2021-39115 Code injection in Jira Service Desk Data Center
Remote attackers with administrator access can execute arbitrary code or commands via Server-Side Template Injection in email templates.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39115?
CVE-2021-39115 is a high-severity code injection vulnerability in Atlassian Jira Service Desk Data Center, published on 1 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
Which versions are affected by CVE-2021-39115?
It affects 2 products.
Products include Atlassian Jira Service Desk, Atlassian Jira Service Management.
How do I fix CVE-2021-39115?
No fix has been published for CVE-2021-39115 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-39115 being exploited?
There is no known exploitation of CVE-2021-39115 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Jira Service Desk Data Center
- CVE-2019-15004 Path traversal in Jira Service Desk Data Center
- CVE-2019-14994 Path traversal in Jira Service Desk Data Center
- CVE-2021-43959 Server-side request forgery in Jira Service Management Data Center
- CVE-2019-15003 Missing authorization in Jira Service Desk Data Center
- CVE-2020-14166 Cross-site scripting in Jira Service Desk Server and Data Center
Sources
Also known as GHSA-82p4-m5cc-j7c9.