CVE-2019-15001
Last modified
CVE-2019-15001 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.. EPSS estimates a 11.37% chance of exploitation in the next 30 days.
Description
The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira Server | >= 7.0.10, < 7.6.16 |
| Atlassian | Jira Server | >= 7.7.0, < 7.13.8 |
| Atlassian | Jira Server | >= 8.0.0, < 8.1.3 |
| Atlassian | Jira Server | >= 8.2.0, < 8.2.5 |
| Atlassian | Jira Server | >= 8.3.0, < 8.3.4 |
| Atlassian | Jira Server | 8.4.0 |
| Atlassian | Jira Data Center | >= 7.0.10, < 7.6.16 |
| Atlassian | Jira Data Center | >= 7.7.0, < 7.13.8 |
| Atlassian | Jira Data Center | >= 8.0.0, < 8.1.3 |
| Atlassian | Jira Data Center | >= 8.2.0, < 8.2.5 |
| Atlassian | Jira Data Center | >= 8.3.0, < 8.3.4 |
| Atlassian | Jira Data Center | 8.4.0 |
References
- http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.htmlThird Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/JRASERVER-69933Release Notes, Vendor Advisory
- https://seclists.org/bugtraq/2019/Sep/42Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.htmlThird Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/JRASERVER-69933Release Notes, Vendor Advisory
- https://seclists.org/bugtraq/2019/Sep/42Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-15001?
How severe is CVE-2019-15001?
How do I fix CVE-2019-15001?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-14996The FilterPickerPopup.jspa resource in Jira before version 7…6.1
- CVE-2019-14997The AccessLogFilter class in Jira before version 8.4.0 allow…4.3
- CVE-2019-14998The Webwork action Cross-Site Request Forgery (CSRF) protect…6.5
- CVE-2019-14999The Uninstall REST endpoint in Atlassian Universal Plugin Ma…
- CVE-2019-1500Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-15000The commit diff rest endpoint in Bitbucket Server and Data C…9.8
- CVE-2019-15002An exploitable CSRF vulnerability exists in Atlassian Jira, …4.3
- CVE-2019-15003The Customer Context Filter in Atlassian Jira Service Desk S…5.3
- CVE-2019-15004The Customer Context Filter in Atlassian Jira Service Desk S…7.5
- CVE-2019-15005The Atlassian Troubleshooting and Support Tools plugin prior…4.3
- CVE-2019-15006There was a man-in-the-middle (MITM) vulnerability present i…6.5
- CVE-2019-15007The review resource in Atlassian Fisheye and Crucible before…4.8
Are you affected by CVE-2019-15001?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST