Description

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Remediation

References

CVE-2019-20409

Related Vulnerabilities

WordPress Plugin NextGEN Gallery-WordPress Gallery Security Bypass (3.1.6)

WordPress Plugin Canto Multiple Server-Side Request Forgery Vulnerabilities (1.7.0)

MySQL CVE-2017-3650 Vulnerability (CVE-2017-3650)

WordPress Plugin LifterLMS-WP LMS for eLearning, Online Courses, & Quizzes Multiple Cross-Site Scripting Vulnerabilities (4.21.0)

Joomla Improper Certificate Validation Vulnerability (CVE-2017-11364)

Severity

Critical

Classification

CVE-2019-20409 CWE-138

Tags

Missing Update Known Vulnerabilities