What’s Vulnerable › Vulnerabilities

CVE-2021-39115

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-01 · updated 2026-06-17
• Weakness: CWE-96

Description

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

Affected products

• Atlassian Jira Service Desk Server: before 4.13.9 — fixed in 4.13.9
• Atlassian Jira Service Management: from 4.14.0 before 4.18.0 — fixed in 4.18.0

How to fix

Upgrade to a fixed version: Atlassian Jira Service Desk Server 4.13.9; Atlassian Jira Service Management 4.18.0. Check the vendor advisory for mitigations.

References

• https://jira.atlassian.com/browse/JSDSERVER-8665
• https://jira.atlassian.com/browse/JSDSERVER-8665

Get alerted when CVE-2021-39115 or the next vulnerability affects your stack