CVE-2020-4019

The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place of the app's cmd.exe via a untrusted search path vulnerability.

Score

CVSS 3.1 7.8 High

Status

Modified - security@atlassian.com

Published

2020-06-01

Last modified

2024-09-16

Weaknesses

CWE-426

Affected products

• Companion (Atlassian)
• Companion App (Atlassian)

References

• https://jira.atlassian.com/browse/CONFSERVER-59734