Atlassian · Jira Server and Data Center
CVE-2019-11581
Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
무엇인가
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
CISA: Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 9월 7일
Atlassian의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2024. 11. 12. | Path Traversal | Jira Server and Data Center | 보통 5.3 | >99.9% |
| 2026. 10. 15. | Files or Directories Accessible to External Parties | Multiple Products | 치명적 9.3 | 99.5% |
| 2024. 1. 24. | Template Injection | Confluence Data Center and Server | 치명적 10.0 | >99.9% |
| 2023. 11. 7. | Improper Authorization | Confluence Data Center and Server | 치명적 10.0 | >99.9% |
| 2023. 10. 5. | Broken Access Control | Confluence Data Center and Server | 치명적 10.0 | 99.2% |
| 2022. 9. 30. | Command Injection | Bitbucket Server and Data Center | 높음 8.8 | 99.1% |
| 2022. 7. 29. | Questions For Confluence App Hard-coded Credentials | Confluence | 치명적 9.8 | 98% |
| 2022. 6. 2. | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | 치명적 9.8 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.