CVE-2021-43942

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
AtlassianJira Server>= unspecified, < 8.13.15; >= 8.14.0, < unspecified; >= unspecified, < 8.20.3
AtlassianJira Data Center>= unspecified, < 8.13.15; >= 8.14.0, < unspecified; >= unspecified, < 8.20.3

References

Timeline

Published
Jan 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439434.8Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrCVE-2021-439447.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. AfCVE-2021-439454.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrarCVE-2021-439466.5Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscrCVE-2021-439477.2Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code viCVE-2021-439484.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privCVE-2021-439494.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vCVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includinCVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conCVE-2021-439514.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import conCVE-2021-439524.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fiCVE-2021-439534.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU mo
CVE-2021-43942: Medium severity, CVSS 6.1 | Vulnix