Detections
Analytics
Atlassian JIRA 7.6.x < 7.6.14, 7.13.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3 RCE
high Nessus Network Monitor Plugin ID 700899
Synopsis
The remote web server hosts an application that is vulnerable to a Remote Code Execution (RCE) vulnerability.Description
The version of JIRA installed on the remote host is earlier than 7.6.x prior to 7.6.14, 7.13.x prior to 7.13.5, 8.0.x prior to 8.0.3, 8.1.x prior to 8.1.2 or 8.2.x prior to 8.2.3 and is affected by a Remote Code Execution (RCE) vulnerability. This vulnerability could allow a remote malicious user to execute arbitrary code on the system, caused by a server-side template injection vulnerability in various resources. If an SMTP server has been configured in Jira and the Contact Administrators Form is enabled or the attacker has "JIRA Administrators" access, an attacker could exploit this vulnerability to execute arbitrary code on the system.Solution
Update to JIRA version 8.2.3 or later. If 8.2.x is not available, 8.1.2, 8.0.3, 7.13.5, and 7.6.14 have also been patched for this vulnerability.See Also
Plugin Details
Severity: High
ID: 700899
Family: CGI
Published: 7/11/2019
Updated: 7/11/2019
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:atlassian:jira
Patch Publication Date: 7/10/2019
Vulnerability Publication Date: 7/10/2019
Reference Information
CVE: CVE-2019-11581