Code injection in Atlassian Jira Service Desk Server
Priority MEDIUM 41CWE-96Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.
Summary
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04483 91st percentileScored 2026-11-07
Fix Fixed Jira Service Desk Server (Atlassian): 4.13.9, 4.18.0Jira Service Desk Data Center (Atlassian): 4.13.9, 4.18.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Atlassian | Jira Service Desk Server | before 4.13.9; 4.14.0 and later; before 4.18.0 | 4.13.9, 4.18.0 | Patch available | CNA |
| Atlassian | Jira Service Desk Data Center | before 4.13.9; 4.14.0 and later; before 4.18.0 | 4.13.9, 4.18.0 | Patch available | CNA |
- Jira Service Desk Server VendorAtlassian Affected before 4.13.9; 4.14.0 and later; before 4.18.0 Fixed in 4.13.9, 4.18.0 Patch available CNA
- Jira Service Desk Data Center VendorAtlassian Affected before 4.13.9; 4.14.0 and later; before 4.18.0 Fixed in 4.13.9, 4.18.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | before 4.13.9 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | before 4.13.9 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* | 4.14.0 to before 4.18.0 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* | 4.14.0 to before 4.18.0 | Vulnerable | Atlassian |
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions before 4.13.9 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions before 4.13.9 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.14.0 to before 4.18.0 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.14.0 to before 4.18.0 Vulnerable ·Atlassian
Remediation
- Fix · CNA Jira Service Desk Server (Atlassian) Fixed in 4.13.9, 4.18.0
- Fix · CNA Jira Service Desk Data Center (Atlassian) Fixed in 4.13.9, 4.18.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39115
- 2026-10-03 Alias added: GHSA-82p4-m5cc-j7c9
References
More Atlassian Jira Service Desk vulnerabilities
- TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
- TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
- TI-2022-09597 Server-side request forgery in Atlassian Jira Core Server CVSS 3.1MEDIUM 6.5
- TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
- TI-2022-09599 Origin validation error in Atlassian Bamboo Server CVSS 3.1HIGH 8.8
- TI-2019-11180 Path traversal in Atlassian Jira Service Desk Server CVSS 3.1HIGH 7.5
Sources
- CVE-2021-39115 · CVE Program
- CVE-2021-39115 · NVD
- FIRST EPSS
- GHSA-82p4-m5cc-j7c9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences