Description

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Remediation

References

CVE-2019-11581

Related Vulnerabilities

Restlet Framework XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2013-4221)

PHP Resource Management Errors Vulnerability (CVE-2012-0789)

WordPress Plugin Easy Accept Payments for PayPal Cross-Site Scripting (4.9.9)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9758)

WordPress Plugin 1 Flash Gallery Cross-Site Scripting and SQL Injection Vulnerabilities (0.2.5)

Severity

Critical

Classification

CVE-2019-11581 CWE-138 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities