CVE-2019-15001 — Code Injection in Atlassian Jira Data Center

CWE-94 — Code Injection3 documents3 sources
Severity
7.2HIGHNVD
EPSS
11.5%
top 6.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Atlassian Jira Data CenterAtlassian Jira Server
Timeline
PublishedSep 19
Latest updateMay 24

Description

The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5atlassian/jira_data_center7.0.10 — unspecified+11
▶NVDatlassian/jira_data_center7.0.10 — 7.6.16+5
▶CVEListV5atlassian/jira_server7.0.10 — unspecified+11
▶NVDatlassian/jira_server7.0.10 — 7.6.16+5

🔴Vulnerability Details

2
GHSA
GHSA-v4p4-65gh-94f7: The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7↗2022-05-24
▶
CVEList
CVE-2019-15001: The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7↗2019-09-19
▶
CVE-2019-15001 — Code Injection in Atlassian | cvebase