CVE-2021-43942: Atlassian Jira Server reflected XSS in collectors template endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium at 6.1 and exploitation requires user interaction, but the high EPSS percentile and unauthenticated network reachability warrant prompt patching.

What it is

Jira Server and Data Center contain a reflected cross-site scripting flaw in the /rest/collectors/1.0/template/custom endpoint, allowing injection of arbitrary HTML or JavaScript. An attacker must lure a victim to a malicious site to trigger it, so exploitation depends on user interaction rather than direct server compromise.

Impact

Successful exploitation lets the attacker run script in the victim's Jira session context, potentially stealing session data or performing actions as the user. The scope change in the CVSS vector indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network via the REST collectors template endpoint with no authentication required, but the victim must be tricked into visiting a malicious website, so user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, though EPSS is high at roughly 0.55 (99th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Upgrade Jira Server and Data Center to version 8.13.15 or later, or 8.20.3 or later for the 8.14.x line.
• If immediate patching is not possible, restrict or monitor access to the /rest/collectors/1.0/template/custom endpoint.
• Deploy a web application firewall rule to block script payloads targeting the collectors template endpoint.
• Educate users about phishing and malicious links, since exploitation requires tricking a user into visiting an attacker-controlled site.

Detection

• Review web and proxy logs for requests to /rest/collectors/1.0/template/custom containing script tags or encoded HTML in parameters.
• Monitor for anomalous outbound requests or referrer patterns consistent with a user being redirected from an external malicious site into Jira.
• Alert on unexpected JavaScript execution or DOM changes reported by browser security tooling on Jira pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.