Description

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."

Remediation

References

CVE-2008-6531

Related Vulnerabilities

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-7416)

WordPress Plugin Schema App Structured Data Unspecified Vulnerability (0.5.4)

WordPress Plugin Simple Ads Manager Arbitrary File Upload (2.5.94)

WordPress Plugin OAuth Single Sign On-SSO (OAuth Client) Security Bypass (6.22.5)

Zope Web Application Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2023-41050)

Severity

Medium

Classification

CVE-2008-6531 CWE-94

Tags

Missing Update Known Vulnerabilities