Description

Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010.

Remediation

References

CVE-2010-1165

Related Vulnerabilities

WordPress Plugin MasterStudy LMS-for Online Courses and Education SQL Injection (3.2.5)

Oracle Application Server Other Vulnerability (CVE-2006-5360)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2009-3094)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-0988)

Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-18679)

Severity

Critical

Tags

Missing Update Known Vulnerabilities CWE-94 CVE-2010-1165