CVE-2010-1165

high

Description

Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/57828

http://www.securityfocus.com/bid/39485

http://www.openwall.com/lists/oss-security/2010/04/16/4

http://www.openwall.com/lists/oss-security/2010/04/16/3

http://secunia.com/advisories/39353

http://jira.atlassian.com/browse/JRA-21004

http://jira.atlassian.com/browse/JRA-20995

http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16

Details

Source: Mitre, NVD

Published: 2010-04-20

Updated: 2017-08-17

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High