CVE-2010-1165: Code Injection
Published Apr 20, 2010
·Updated
Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010.
Affected Software
14 affected components
Atlassian Jira=3.12
Atlassian Jira=3.12.1
Atlassian Jira=3.12.2
Atlassian Jira=3.12.3
Atlassian Jira=3.13
Atlassian Jira=3.13.1
Atlassian Jira=3.13.2
Atlassian Jira=3.13.3
Atlassian Jira=3.13.4
Atlassian Jira=3.13.5
Atlassian Jira=4.0
Atlassian Jira=4.0.1
Atlassian Jira=4.0.2
Atlassian Jira=4.1
Remediation
Patch Available
Event History
Apr 20, 2010
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-1165?
CVE-2010-1165 has a high severity rating due to the potential for remote code execution.
2
How do I fix CVE-2010-1165?
To fix CVE-2010-1165, upgrade to a patched version of Atlassian JIRA that addresses this vulnerability.
3
What versions of Atlassian JIRA are affected by CVE-2010-1165?
CVE-2010-1165 affects Atlassian JIRA versions 3.12 through 4.1.
4
Can CVE-2010-1165 be exploited remotely?
Yes, CVE-2010-1165 can be exploited remotely by authenticated administrators.
5
What types of attacks are possible with CVE-2010-1165?
CVE-2010-1165 allows for arbitrary code execution through file uploads.