Skip to content
Back to search

CVE-2021-43947

HIGH
7.2NVD

Summary

generated automatically from NVD data

Atlassian Jira Server and Data Center contain a remote code execution flaw in the Email Templates feature, which can be abused by remote attackers who already hold administrator privileges. The issue bypasses the fix for JSDSERVER-8665 and affects versions before 8.13.15, as well as 8.14.0 up to but not including 8.20.3. Successful exploitation allows arbitrary code execution, and the flaw has a CVSS v3.1 score of 7.2 (HIGH).

NVD description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

Share:

EPSS · FIRST.org

4.1%probability of exploitation in the next 30 days

Higher than 90% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

CVSS v3.1 Score

7.2
/ 10.0
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Information

Published
6 janv. 2022
Updated
17 juin 2026
Status
Modified
Source
security@atlassian.com

Affected products

atlassian data center
Versions : 8.13.15
atlassian jira
Versions : 8.13.15
atlassian jira data center
Versions : 8.20.3
atlassian jira server
Versions : 8.20.3

Weaknesses (CWE)

NVD-CWE-noinfo

References (2)

Similar CVEs

Other vulnerabilities of type

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring