CVE-2021-39128

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391317.5ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node CVE-2021-391328.8Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3,CVE-2021-391336.8Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3,CVE-2021-391347.8`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line in CVE-2021-391357.8`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line inte CVE-2021-391365.4baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site s CVE-2021-391377.5go-ethereum is the official Go implementation of the Ethereum protocol. In affected versions a consensus-vulnerability in go-ethereum (Geth)CVE-2021-391386.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to s CVE-2021-391398.8XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-39146.1It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to co CVE-2021-391406.3XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker CVE-2021-391418.5XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker