Published: 09/08/2019 Updated: 25/03/2022

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 830

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 prior to 7.6.14, from 7.7.0 prior to 7.13.5, from 8.0.0 prior to 8.0.3, from 8.1.0 prior to 8.1.2, and from 8.2.0 prior to 8.2.3 are affected by this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
atlassian jira server
atlassian jira

Atlassian JIRA Template injection vulnerability RCE

CVE-2019-11581 Atlassian JIRA Template injection vulnerability RCE Demo python CVE-2019-11581py xxxxxxxx:8080/ "Command" Vuln Version Download product-downloadsatlassiancom/software/jira/downloads/atlassian-jira-software-7130-x64exe Poc $i18ngetClass()forName('javalangRuntime')getMethod('getRuntime',null)invoke(null,

One stop place for exploiting Jira instances in your proximity

Jiraffe Jiraffe - One stop place for exploiting all Jira instances in your proximity Installation    |    Usage    |    Demo    |    Documentation Features Jiraffe is a sem

Remote code execution in Atlassian Jira(CVE-2019–11581) through template engine FreeMaker

RCE-in-Jira Remote code execution in Atlassian Jira(CVE-2019–11581) through template engine FreeMaker В апреле месяце была обнаружена RCE в продукте Atlassian Confluence, а если быть точнее в плагине, который почти всегда там используется И вот через 4 месяца ещ�

CVE-2019–11581 PoC

Template Injection in Email Templates leads to code execution on Jira Service Management Server

CVE-2021-39115 Template Injection in Email Templates leads to code execution on Jira Service Management Server I) Bulding Mình đã hướng dẫn deploy + debug ở đây, các bạn có thể tham khảo II) Phân tích Trong Description của CVE này cũng đã nói rõ là bug nằm ở tính nă

Atlassian Jira unauthen template injection

Atlassian Jira unauthen template injection (CVE-2019-11581) I) Building 1 Bug version 44x 5xx 6xx 70x 71x 72x 73x 74x 75x 76x before 7614 (the fixed version for 76x) 77x 78x 79x 710x 711x 712x 713x before 7135 (the fixed version for 713x) 80x before 803 (the fixed version for 80x) 81x before 812 (the fixed version for 81x)

One stop place for exploiting Jira instances in your proximity

Jiraffe Jiraffe - One stop place for exploiting all Jira instances in your proximity Installation    |    Usage    |    Demo    |    Documentation Features Jiraffe is a sem

CWE-74 https://jira.atlassian.com/browse/JRASERVER-69532 https://nvd.nist.gov https://github.com/jas502n/CVE-2019-11581

CVE-2019-11581

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect