CVE-2019-10100
Last modified
CVE-2019-10100 is a vulnerability of currently unknown severity. In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.. EPSS estimates a 2.23% chance of exploitation in the next 30 days.
Description
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jetbrains | Youtrack Integration | < 1.8.1.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10100?
How severe is CVE-2019-10100?
How do I fix CVE-2019-10100?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10095bash command injection vulnerability in Apache Zeppelin allo…9.8
- CVE-2019-10096Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-10097In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was c…7.2
- CVE-2019-10098In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured …6.1
- CVE-2019-10099Prior to Spark 2.3.3, in certain situations Spark would writ…7.5
- CVE-2019-1010An information disclosure vulnerability exists when the Wind…4.7
- CVE-2019-1010003Leanote prior to version 2.6 is affected by: Cross Site Scri…
- CVE-2019-1010004SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-…
- CVE-2019-1010005HexoEditor v1.1.8-beta is affected by: XSS to code execution…
- CVE-2019-1010006Evince 3.26.0 is affected by buffer overflow. The impact is:…7.8
- CVE-2019-1010008OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cros…
- CVE-2019-1010009DGLogik Inc DGLux Server All Versions is affected by: Insecu…
Are you affected by CVE-2019-10100?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST