CVE-2021-43948

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439494.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vCVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includinCVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conCVE-2021-439514.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import conCVE-2021-439524.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fiCVE-2021-439534.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU moCVE-2021-439544.3The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository CVE-2021-439554.3The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain infCVE-2021-439566.1The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaCVE-2021-439577.5Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (ICVE-2021-439589.8Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest rCVE-2021-439595.7Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of
CVE-2021-43948: Medium severity, CVSS 4.3 | Vulnix