CVE-2021-43945

4.8 mediumEPSS 0.6%

Medium (4.8) in atlassian. EPSS 0.6% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-02-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:data_center
atlassian:jira

References

https://jira.atlassian.com/browse/JRASERVER-73069
https://jira.atlassian.com/browse/JRASERVER-73069

Check your stack JSON