CVE-2021-43959
Description
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.
How to fix
- atlassian jira_service_desk4.13.20 or later
- atlassian jira_service_management4.20.8, 4.22.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira_service_desk | v < 4.13.20 | 4.13.20 |
| atlassian jira_service_management | 4.14.0 ≤ v < 4.20.8, 4.21.0 ≤ v < 4.22.2 | 4.20.8, 4.22.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.