Server-side request forgery in Atlassian Jira Service Management Server
Priority LOW 27CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.
Summary
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0072 54th percentileScored 2026-11-07
Fix Fixed Jira Service Management Server (Atlassian): 4.13.20, 4.20.8, 4.22.2Jira Service Management Data Center (Atlassian): 4.13.20, 4.20.8, 4.22.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Atlassian | Jira Service Management Server | before 4.13.20; 4.14.0 and later; before 4.20.8; 4.21.0 and later; before 4.22.2 | 4.13.20, 4.20.8, 4.22.2 | Patch available | CNA |
| Atlassian | Jira Service Management Data Center | before 4.13.20; 4.14.0 and later; before 4.20.8; 4.21.0 and later; before 4.22.2 | 4.13.20, 4.20.8, 4.22.2 | Patch available | CNA |
- Jira Service Management Server VendorAtlassian Affected before 4.13.20; 4.14.0 and later; before 4.20.8; 4.21.0 and later; before 4.22.2 Fixed in 4.13.20, 4.20.8, 4.22.2 Patch available CNA
- Jira Service Management Data Center VendorAtlassian Affected before 4.13.20; 4.14.0 and later; before 4.20.8; 4.21.0 and later; before 4.22.2 Fixed in 4.13.20, 4.20.8, 4.22.2 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* | before 4.13.20 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* | before 4.13.20 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* | 4.14.0 to before 4.20.8 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* | 4.14.0 to before 4.20.8 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* | 4.21.0 to before 4.22.2 | Vulnerable | Atlassian |
| cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* | 4.21.0 to before 4.22.2 | Vulnerable | Atlassian |
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions before 4.13.20 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions before 4.13.20 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.14.0 to before 4.20.8 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.14.0 to before 4.20.8 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.21.0 to before 4.22.2 Vulnerable ·Atlassian
- cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.21.0 to before 4.22.2 Vulnerable ·Atlassian
Remediation
- Fix · CNA Jira Service Management Server (Atlassian) Fixed in 4.13.20, 4.20.8, 4.22.2
- Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in 4.13.20, 4.20.8, 4.22.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43959
- 2026-10-03 Alias added: GHSA-5rqp-fx48-4mvw
References
More Atlassian Jira Service Desk vulnerabilities
- TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
- TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
- TI-2022-09597 Server-side request forgery in Atlassian Jira Core Server CVSS 3.1MEDIUM 6.5
- TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
- TI-2022-09599 Origin validation error in Atlassian Bamboo Server CVSS 3.1HIGH 8.8
- TI-2019-11180 Path traversal in Atlassian Jira Service Desk Server CVSS 3.1HIGH 7.5
Sources
- CVE-2021-43959 · CVE Program
- CVE-2021-43959 · NVD
- FIRST EPSS
- GHSA-5rqp-fx48-4mvw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences