We internally discovered that the HipChat For JIRA plugin had a resource that combined user input into a velocity template source and subsequently rendered it. Authenticated attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of the HipChat For JIRA plugin enabled. To exploit this issue attackers need to be able to access the JIRA web interface and log into JIRA. Vulnerable versions of the HipChat for JIRA plugin were bundled by default with JIRA since JIRA version 6.3.5, up to but not including 6.4.11 (the fixed version).
Affected versions:
Fix:
Risk Mitigation:
For additional details see the [full advisory|https://confluence.atlassian.com/x/IcBKLg].
CPE | Name | Operator | Version |
---|---|---|---|
jira data center | le | 6.3.5 | |
jira data center | le | 6.4.10 | |
jira data center | lt | 6.4.11 |