According to its self-reported version number, the Atlassian Jira application running on the remote host is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of JIRA installed on the remote host is earlier than 7.6.x prior to 7.6.14, 7.13.x prior to 7.13.5, 8.0.x prior to 8.0.3, 8.1.x prior to 8.1.2 or 8.2.x prior to 8.2.3 and is affected by a Remote Code Execution (RCE) vulnerability. This vulnerability could allow a remote malicious user to execute arbitrary code on the system, caused by a server-side template injection vulnerability in various resources. If an SMTP server has been configured in Jira and the Contact Administrators Form is enabled or the attacker has "JIRA Administrators" access, an attacker could exploit this vulnerability to execute arbitrary code on the system.

ID	Name	Product	Family	Published	Updated	Severity
98655	Atlassian Jira 8.2.x < 8.2.3 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	8/12/2019	3/14/2023	critical
98654	Atlassian Jira 8.1.x < 8.1.2 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	8/12/2019	3/14/2023	critical
98653	Atlassian Jira 8.0.x < 8.0.3 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	8/12/2019	3/14/2023	critical
98652	Atlassian Jira 7.7.x < 7.13.5 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	8/12/2019	3/14/2023	critical
98651	Atlassian Jira 4.4.x < 7.6.14 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	8/12/2019	3/14/2023	critical
128762	Atlassian JIRA Server Template Injection Vulnerability (CVE-2019-11581)	Nessus	CGI abuses	9/13/2019	11/12/2024	critical
126620	Atlassian JIRA Server & JIRA Data Center Template Injection Vulnerability	Nessus	CGI abuses	7/11/2019	6/5/2024	critical
700899	Atlassian JIRA 7.6.x < 7.6.14, 7.13.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3 RCE	Nessus Network Monitor	CGI	7/11/2019	7/11/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

high