CVE-2019-20409

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1160%

EPSS Percentile37.36th

PublishedJun 23, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Affected Platforms (CPE)

📦

Atlassian

Jira

< 8.8.0

📦

Atlassian

Jira Software Data Center

< 8.8.0

References & Advisories

🔗 https://jira.atlassian.com/browse/JRASERVER-70944

Related Vulnerabilities

CVE-2019-165419.9

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing ...

CVE-2020-141729.8

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has b...

CVE-2019-115819.8

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the Send...

CVE-2020-362399.8

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, fro...