CVE-2020-14172
Critical
Description
This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote code execution via insecure deserialization, if they were able to exploit a server side template injection vulnerability. The affected versions are before version 7.13.0, from version 8.0.0 before 8.5.0, and from version 8.6.0 before version 8.8.1.
SeverityCritical
CVSS9.8
Exploit probability85. percentile2.5%
Product
Atlassian Jira
PublishedJul 3, 2020
First seenJul 3, 2020
How to fix
Update
- atlassian jira7.13.0, 8.5.0, 8.8.1 or later
- atlassian jira_software_data_center7.13.0, 8.5.0, 8.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atlassian jira | v < 7.13.0, 8.0.0 ≤ v < 8.5.0, 8.6.0 ≤ v < 8.8.1 | 7.13.0, 8.5.0, 8.8.1 |
| atlassian jira_software_data_center | v < 7.13.0, 8.0.0 ≤ v < 8.5.0, 8.6.0 ≤ v < 8.8.1 | 7.13.0, 8.5.0, 8.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.