CVE-2019-15001

The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:8.4.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:8.4.0:*:*:*:*:*:*:*

History

22 Apr 2022, 19:53

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_data_center:8.4.0:*:*:*:*:*:*:*
First Time Atlassian jira Data Center
References (MISC) http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html - (MISC) http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html - Third Party Advisory, VDB Entry
References (BUGTRAQ) https://seclists.org/bugtraq/2019/Sep/42 - (BUGTRAQ) https://seclists.org/bugtraq/2019/Sep/42 - Mailing List, Third Party Advisory

25 Mar 2022, 17:22

Type Values Removed Values Added
CPE cpe:2.3:a:atlassian:jira:8.4.0:*:*:*:*:*:*:* cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:jira_server:8.4.0:*:*:*:*:*:*:*
First Time Atlassian jira Server

Information

Published : 2019-09-19 15:15

Updated : 2023-12-10 12:59


NVD link : CVE-2019-15001

Mitre link : CVE-2019-15001

CVE.ORG link : CVE-2019-15001


JSON object : View

Products Affected

atlassian

  • jira_data_center
  • jira_server
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')