vulnerability
Atlassian JIRA: Improper Control of Generation of Code ('Code Injection') (CVE-2021-43944)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:S/C:P/I:P/A:P) | Mar 8, 2022 | Mar 17, 2022 | Mar 17, 2022 |
Severity
7
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
Published
Mar 8, 2022
Added
Mar 17, 2022
Modified
Mar 17, 2022
Description
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.
Solution(s)
atlassian-jira-upgrade-8_13_15atlassian-jira-upgrade-8_20_3
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.