Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.

According to its self-reported version number, the Atlassian Jira application running on the remote host is < 8.13.12 or 8.14.x < 8.19.1. It is, therefore, affected by a vulnerability that when using the Jira Service Management addon may allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113682	Atlassian Jira 8.14.x < 8.19.1 Server-Side Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high
113681	Atlassian Jira < 8.13.12 Server-Side Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2021-39128

high

Tenable Plugins

high

high