CVE-2021-39112: atlassian data_center
Vulnerability summary
CVE-2021-39112 is a medium (CVSS 4.9) vulnerability in atlassian data_center. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62.6% of scored vulnerabilities.
Not severe (CVSS 4.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 25-08-2021PublishedVulnerability first disclosed.
- 11-10-2024Last modifiedVulnerability information updated.
Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.99%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.99% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1022Use of Web Link to Untrusted Target with window.opener AccessThe web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
- CWE-601URL Redirection to Untrusted SiteThe web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Known conditions: network-reachable, administrative account, user interaction (CVSS vector). Other conditions: not stated in public data.
Atlassian4 products
- data_center< 8.5.15
- jira< 8.5.15
- jira_data_center≥ unspecified, < 8.5.15 | ≥ 8.6.0, < unspecified | ≥ unspecified, < 8.13.7 | ≥ 8.14.0, < unspecified | ≥ unspecified, < 8.17.1 | ≥ 8.18.0, < unspecified | ≥ unspecified, < 8.18.1 | ≥ 8.6.0, < 8.13.7 | ≥ 8.14.0, < 8.17.1 | ≥ 8.18.0, < 8.18.1
- jira_server≥ unspecified, < 8.5.15 | ≥ 8.6.0, < unspecified | ≥ unspecified, < 8.13.7 | ≥ 8.14.0, < unspecified | ≥ unspecified, < 8.17.1 | ≥ 8.18.0, < unspecified | ≥ unspecified, < 8.18.1 | ≥ 8.6.0, < 8.13.7 | ≥ 8.14.0, < 8.17.1 | ≥ 8.18.0, < 8.18.1
1 vendor · 4 products