CVE-2019-8442: High severity Atlassian Jira vulnerability
The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jirato a version that resolves this vulnerability.Fixed in 7.13.4 - Upgrade
Upgrade
Jirato a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
Jirato a version that resolves this vulnerability.Fixed in 8.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8442?
CVE-2019-8442 has been classified as a high severity vulnerability.
How do I fix CVE-2019-8442?
To fix CVE-2019-8442, upgrade to Jira versions 7.13.4, 8.0.4, or 8.1.1 or later.
What systems are affected by CVE-2019-8442?
CVE-2019-8442 affects Jira versions prior to 7.13.4, and versions from 8.0.0 to 8.0.4, and from 8.1.0 to 8.1.1.
What type of attack can occur due to CVE-2019-8442?
CVE-2019-8442 allows remote attackers to access sensitive files in the Jira webroot.
Is CVE-2019-8442 a local or remote vulnerability?
CVE-2019-8442 is a remote vulnerability.