CVE-2021-43949

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includinCVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conCVE-2021-439514.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import conCVE-2021-439524.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fiCVE-2021-439534.3Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU moCVE-2021-439544.3The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository CVE-2021-439554.3The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain infCVE-2021-439566.1The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaCVE-2021-439577.5Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (ICVE-2021-439589.8Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest rCVE-2021-439595.7Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of CVE-2021-43964.3The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or
CVE-2021-43949: Medium severity, CVSS 4.3 | Vulnix