CVE-2021-43947

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jan 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439484.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privCVE-2021-439494.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vCVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includinCVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conCVE-2021-439514.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import conCVE-2021-439524.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fiCVE-2021-439534.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU moCVE-2021-439544.3The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository CVE-2021-439554.3The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain infCVE-2021-439566.1The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaCVE-2021-439577.5Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (ICVE-2021-439589.8Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest r