Lucene search

K
nessusThis script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.JIRA_CVE_2019_11581_TEMPLATE_INJECTION.NBIN
HistorySep 13, 2019 - 12:00 a.m.

Atlassian JIRA Server Template Injection Vulnerability (CVE-2019-11581)

2019-09-1300:00:00
This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
24

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

Binary data jira_cve_2019_11581_template_injection.nbin
VendorProductVersionCPE
atlassianjiracpe:/a:atlassian:jira