CVE-2021-43959

published 2022-07-26

CVE-2021-43959: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network…

medium 5.7 CVSS 3.1

AV N AC L PR L UI R S U C H I N A N

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
atlassian	jira_service_desk	< 4.13.20	4.13.20
atlassian	jira_service_management	>= 4.14.0 < 4.20.8	4.20.8
atlassian	jira_service_management	>= 4.21.0 < 4.22.2	4.22.2
atlassian	jira_service_management_data_center	>= 4.14.0 < unspecified	unspecified
atlassian	jira_service_management_data_center	>= 4.21.0 < unspecified	unspecified
atlassian	jira_service_management_data_center	>= unspecified < 4.13.20	4.13.20
atlassian	jira_service_management_data_center	>= unspecified < 4.20.8	4.20.8
atlassian	jira_service_management_data_center	>= unspecified < 4.22.2	4.22.2
atlassian	jira_service_management_server	>= 4.14.0 < unspecified	unspecified
atlassian	jira_service_management_server	>= 4.21.0 < unspecified	unspecified
atlassian	jira_service_management_server	>= unspecified < 4.13.20	4.13.20
atlassian	jira_service_management_server	>= unspecified < 4.20.8	4.20.8
atlassian	jira_service_management_server	>= unspecified < 4.22.2	4.22.2

CWE-918