Description

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Remediation

References

CVE-2019-20409

Related Vulnerabilities

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-3233)

MySQL CVE-2016-3424 Vulnerability (CVE-2016-3424)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3176)

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Security Bypass (3.5.7)

RubyGems Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2018-1000075)

Severity

Critical

Classification

CVE-2019-20409 CWE-138

Tags

Missing Update Known Vulnerabilities