VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Aug 30, 2021· Updated Jun 17, 2026

CVE-2021-39111

CVE-2021-39111

Description

The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • Atlassian/Data Center
    cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
    Range: <8.5.18
  • Atlassian/Jira2 versions
    cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*range: <8.5.18
    • (no CPE)range: before 8.5.18, 8.6.0 before 8.13.10, 8.14.0 before 8.18.2
  • Atlassian/Jira Data Center
    cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
    Range: >=8.6.0,<8.13.10
  • Atlassian/Jira Server2 versions
    cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*range: >=8.6.0,<8.13.10
    • (no CPE)range: unspecified
  • Atlassian/Crowd Data Center and Serverllm-fuzzy
    Range: before 8.5.18, 8.6.0 before 8.13.10, 8.14.0 before 8.18.2
  • Atlassian/Jira Core Data Centercpe-rescue
    Range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.