CVE-2021-39115
Assigner: atlassian
Published: 2021-08-30T00:00:00
State: PUBLISHED
affected: product: Jira Service Desk Server
vendor: Atlassian
versions: lessThan: 4.13.9
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: affected
version: 4.14.0
versionType: custom
lessThan: 4.18.0
status: affected
version: unspecified
versionType: custom
product: Jira Service Desk Data Center
vendor: Atlassian
versions: lessThan: 4.13.9
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: affected
version: 4.14.0
versionType: custom
lessThan: 4.18.0
status: affected
version: unspecified
versionType: custom
datePublic: 2021-08-30T00:00:00
descriptions: value: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
problemTypes: descriptions: cweId: CWE-96
description: CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
type: CWE