The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is potentially affected by a template injection vulnerability in the Jira Importers Plugin. An unauthenticated, remote attacker can exploit this issue to execute arbitrary commands on the target host.

According to its self-reported version number, the Atlassian Jira application running on the remote host is 7.0.10 < 7.6.16, 7.7.x < 7.13.8, 8.1.x < 8.1.3, 8.2.x < 8.2.5, 8.3.x < 8.3.4, 8.4.x < 8.4.1. It is, therefore, affected by a server-side template injection vulnerability that exists in the Jira Importers Plugin (JIM). An attacker with "Jira Administrators" access may exploit this to execute arbitrary code.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
130591	Atlassian Jira Server and Data Center Template Injection Vulnerability (JRASERVER-69933)	Nessus	CGI abuses	high
98725	Atlassian Jira 8.4.x < 8.4.1 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high
98724	Atlassian Jira 8.3.x < 8.3.4 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high
98723	Atlassian Jira 8.2.x < 8.2.5 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high
98722	Atlassian Jira 8.1.x < 8.1.3 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high
98721	Atlassian Jira 7.7.x < 7.13.8 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high
98719	Atlassian Jira 7.0.10 < 7.6.16 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2019-15001

high

Tenable Plugins

high

high

high

high

high

high

high