Description

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Remediation

References

CVE-2019-20409

Related Vulnerabilities

WordPress Plugin BePro Listings Arbitrary File Upload (2.2.0020)

Next.js Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-44581)

PostgreSQL Out-of-bounds Write Vulnerability (CVE-2019-10164)

Envoy Proxy Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2024-45806)

WordPress Plugin Answer My Question Cross-Site Scripting (1.3)

Severity

Critical

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2019-20409