CVE-2019-8442: High severity atlassian jira vulnerability
Published May 22, 2019
·Updated
The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.
Affected Software
3 affected components
Atlassian Jira<7.13.4
Atlassian Jira Server>=8.0.0<8.0.4
Atlassian Jira Server>=8.1.0<8.1.1
Event History
May 22, 2019
CVE Published
via MITRE·05:39 PM
Data Sourced
via MITRE·05:39 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-8442?
CVE-2019-8442 has been classified as a high severity vulnerability.
2
How do I fix CVE-2019-8442?
To fix CVE-2019-8442, upgrade to Jira versions 7.13.4, 8.0.4, or 8.1.1 or later.
3
What systems are affected by CVE-2019-8442?
CVE-2019-8442 affects Jira versions prior to 7.13.4, and versions from 8.0.0 to 8.0.4, and from 8.1.0 to 8.1.1.
4
What type of attack can occur due to CVE-2019-8442?
CVE-2019-8442 allows remote attackers to access sensitive files in the Jira webroot.
5
Is CVE-2019-8442 a local or remote vulnerability?
CVE-2019-8442 is a remote vulnerability.