CVE-2021-43943

🗓️ 24 Feb 2022 04:40:09Reported by atlassianType

cve🔗 web.nvd.nist.gov👁 105 Views🌐 WEB

CVE-2021-43943 XSS vulnerability in Atlassian Jira Service Managemen

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2021-43943	30 Dec 202100:00	–	attackerkb
CNNVD	Atlassian Jira 跨站脚本漏洞	24 Feb 202200:00	–	cnnvd
CNVD	Atlassian Jira Service Management Server and Data Cente Cross-Site Scripting Vulnerability	28 Feb 202200:00	–	cnvd
Cvelist	CVE-2021-43943	24 Feb 202204:40	–	cvelist
EUVD	EUVD-2021-30805	3 Oct 202520:07	–	euvd
Atlassian	Stored XSS in "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa - CVE-2021-43943	22 Dec 202103:05	–	atlassian
NVD	CVE-2021-43943	24 Feb 202205:15	–	nvd
OSV	CVE-2021-43943	24 Feb 202205:15	–	osv
Prion	Cross site scripting	24 Feb 202205:15	–	prion
Vulnrichment	CVE-2021-43943	24 Feb 202204:40	–	vulnrichment

NVD

Node

atlassian jira_service_managementRange<4.21.0data_center

atlassian jira_service_managementRange<4.21.0server

[
  {
    "product": "Jira Service Management Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Jira Service Management Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jira	www.jira.atlassian.com/browse/JSDSERVER-10980

Parameter	Position	Path	Description	CWE
Object Schema	request body	secure/admin/InsightDefaultCustomFieldConfig.jspa	Cross-site scripting vulnerability in Object Schema field allowing injection of arbitrary HTML/JavaScript by attackers with administrator privileges.	CWE-79

17 Jun 2026 04:11Current

4.8Medium risk

Vulners AI Score4.8

CVSS 23.5

CVSS 3.14.8

EPSS0.00422

SSVC

CWE-79