Description

Jira is vulnerable to a server side template injection vulnerability, which leads to remote code execution.

Remediation

Upgrade to the latest version of Jira

References

CVE-2019-11581

JRASERVER-69532

Related Vulnerabilities

ExpressJs Local File Read via the layout parameter

Apache Tomcat version older than 5.5.27

Atlassian Jira Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2014-2313)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Directory Traversal (1.7.14.2)

WordPress Plugin Image Optimizer by 10web-Image Optimizer and Compression Directory Traversal (1.0.25)

Severity

High

Classification

CVE-2019-11581 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Server Side Template Injection