Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to e…

published 2021-09-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-25551

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 4.5%; EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

Patch / fix

fixed in 4

Atlassian Jira Service Desk Server 4.13.9, 4.18.0
Atlassian Jira Service Desk Data Center 4.13.9, 4.18.0
atlassian jira_service_management 4.18.0
atlassian jira_service_desk 4.13.9

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-10-11)

Exploit prediction

4.48% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

Atlassian Jira Service Desk Server
Atlassian Jira Service Desk Data Center
atlassian jira_service_management
atlassian jira_service_desk

Classification

Weakness

CWE-96 Improper Neutralization of Directives in Statically Saved Code
CWE-94 Improper Control of Generation of Code

References

jira.atlassian.com /browse/JSDSERVER-8665
third-party-advisory

Sources

CVE List CVE-2021-39115
NVD CVE-2021-39115

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary