CVE-2019-15001: Code Injection
First published: Tue Sep 18 2018(Updated: )
The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.
Credit: security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian Server | >=7.0.10<7.6.16 | |
| Atlassian Server | >=7.7.0<7.13.8 | |
| Atlassian Server | >=8.0.0<8.1.3 | |
| Atlassian Server | >=8.2.0<8.2.5 | |
| Atlassian Server | >=8.3.0<8.3.4 | |
| Atlassian Server | =8.4.0 | |
| Atlassian Data Center | >=7.0.10<7.6.16 | |
| Atlassian Data Center | >=7.7.0<7.13.8 | |
| Atlassian Data Center | >=8.0.0<8.1.3 | |
| Atlassian Data Center | >=8.2.0<8.2.5 | |
| Atlassian Data Center | >=8.3.0<8.3.4 | |
| Atlassian Data Center | =8.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-15001?
CVE-2019-15001 is classified as a critical vulnerability, allowing attackers with Administrator permissions to execute remote code.
How do I fix CVE-2019-15001?
To fix CVE-2019-15001, upgrade your Jira Server or Data Center to a version that is not vulnerable, specifically to version 7.6.16 or later, or 8.x versions that are 8.1.3 or later.
Who is affected by CVE-2019-15001?
CVE-2019-15001 affects users of Jira Server and Data Center versions 7.0.10 through 7.6.16, and 7.7.0 through 8.4.1.
What types of vulnerabilities does CVE-2019-15001 represent?
CVE-2019-15001 represents a template injection vulnerability that can be exploited if an attacker has Administrator privileges.
When was CVE-2019-15001 discovered?
CVE-2019-15001 was publicly disclosed on September 2019.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/atlassian
- canonical/atlassian server
- version/atlassian server/7.0.10
- version/atlassian server/7.7.0
- version/atlassian server/8.0.0
- version/atlassian server/8.2.0
- version/atlassian server/8.3.0
- version/atlassian server/8.4.0
- canonical/atlassian data center
- version/atlassian data center/7.0.10
- version/atlassian data center/7.7.0
- version/atlassian data center/8.0.0
- version/atlassian data center/8.2.0
- version/atlassian data center/8.3.0
- version/atlassian data center/8.4.0