Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

According to its self-reported version number, the Atlassian Jira Service Management application running on the remote host is version 4.14.x prior to 4.18.0. It is, therefore, affected by a flaw which may allow remote attackers with Jira Administrator access to execute arbitrary Java code or system commands via a server side template injection vulnerability in the Email template feature\n Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
113881	Atlassian Jira Service Management 4.14.0 < 4.18.0 Template Injection Code Execution	Web App Scanning	Component Vulnerability	Version Based	high
113878	Atlassian Jira Service Desk < 4.13.9 Template Injection Code Execution	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2021-39115

high

Tenable Plugins

high

high