Code injection

2020-07-1301:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.0%

JSON

The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.

CPENameOperatorVersion
jiralt8.5.4
jira_data_centerge8.5.5
jira_data_centerlt8.6.1
jira_data_centerge8.6.2
jira_data_centerlt8.7.0
jira_serverge8.6.2
jira_serverlt8.7.0
jira_serverge8.5.5
jira_serverlt8.6.1
jira_software_data_centerlt8.5.4

Name	Operator	Version
jira	lt	8.5.4
jira_data_center	ge	8.5.5
jira_data_center	lt	8.6.1
jira_data_center	ge	8.6.2
jira_data_center	lt	8.7.0
jira_server	ge	8.6.2
jira_server	lt	8.7.0
jira_server	ge	8.5.5
jira_server	lt	8.6.1
jira_software_data_center	lt	8.5.4

References

jira.atlassian.com/browse/JRASERVER-70808