CVE-2019-20409

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@atlassian.com

Published

2020-06-23

Last modified

2024-09-17

Weaknesses

CWE-74

Affected products

• Jira (Atlassian)
• Jira Server (Atlassian)
• Jira Software Data Center (Atlassian)

References

• https://jira.atlassian.com/browse/JRASERVER-70944