CVE-2021-43947

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Atlassian	Jira Server	>= unspecified, < 8.13.15; >= 8.14.0, < unspecified; >= unspecified, < 8.20.3
Atlassian	Jira Data Center	>= unspecified, < 8.13.15; >= 8.14.0, < unspecified; >= unspecified, < 8.20.3
atlassian	jira_data_center	< 8.13.15; >= 8.14.0, < 8.20.3
atlassian	jira_server	< 8.13.15; >= 8.14.0, < 8.20.3

References

https://jira.atlassian.com/browse/JRASERVER-73067Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-73067Issue Tracking, Vendor Advisory

Timeline

Published: Jan 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-439484.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of priv CVE-2021-439494.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects v CVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin CVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source con CVE-2021-439514.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import con CVE-2021-439524.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fi CVE-2021-439534.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU mo CVE-2021-439544.3The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository CVE-2021-439554.3The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain inf CVE-2021-439566.1The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or Java CVE-2021-439577.5Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (I CVE-2021-439589.8Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest r