# CVE-2021-39115: Atlassian Jira Service Desk Server

- Exploited (CISA KEV): no
- Published: 2021-09-01
- CVSS: 7.2 HIGH (v3.1)
- EPSS: 4.5% (91th percentile)
- CWE: CWE-96

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-06-30 | 1398 |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### F5

- 2025-06-30 · new · rule 200204018
  > Added: signature 200204018 "Java code injection - org.springframework.expression.spel.standard.SpelExpressionParser (Parameter)" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Apache Tomcat, BEA Systems WebLogic Server, Apache Struts, JBoss, JavaServer Faces (JSF), Spring Boot. References: CVE-2021-39115.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-06-30 · new · rule 200204019
  > Added: signature 200204019 "Java code injection - org.springframework.expression.spel.standard.SpelExpressionParser (Header)" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Apache Tomcat, BEA Systems WebLogic Server, Apache Struts, JBoss, JavaServer Faces (JSF), Spring Boot. References: CVE-2021-39115.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2021-39115 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2021-39115