CVE-2019-15001

The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.

Score

CVSS 3.1 7.2 High

Status

Modified - security@atlassian.com

Published

2019-09-19

Last modified

2024-09-16

Weaknesses

CWE-94

Affected products

• Jira Data Center (Atlassian)
• Jira Server (Atlassian)

References

• http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html
• https://jira.atlassian.com/browse/JRASERVER-69933
• https://seclists.org/bugtraq/2019/Sep/42