Read the docs
TI-2017-13320 Aliases CVE-2017-18113GHSA-7q5w-8wg2-xwr7

Code injection in Atlassian Jira Server

Priority MEDIUM 44CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and other Jira dependencies. Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01802 78th percentileScored 2026-11-07
Fix Fixed Jira Server (Atlassian): 8.18.1Jira Data Center (Atlassian): 8.18.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Serverbefore 8.18.18.18.1Patch availableCNA
AtlassianJira Data Centerbefore 8.18.18.18.1Patch availableCNA
  • Jira Server VendorAtlassian Affected before 8.18.1 Fixed in 8.18.1 Patch available CNA
  • Jira Data Center VendorAtlassian Affected before 8.18.1 Fixed in 8.18.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*before 8.18.1VulnerableAtlassian
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*before 8.18.1VulnerableAtlassian
  • cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:* Versions before 8.18.1 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:* Versions before 8.18.1 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Server (Atlassian) Fixed in 8.18.1
  • Fix · CNA Jira Data Center (Atlassian) Fixed in 8.18.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-18113
  2. 2026-10-03 Alias added: GHSA-7q5w-8wg2-xwr7

References

Advisory 1

  • TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
  • TI-2020-11107 Information disclosure in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
  • TI-2021-16503 Insufficient session expiration in Atlassian Jira Server CVSS 3.1HIGH 7.5
  • TI-2020-17687 Path traversal in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
  • TI-2021-16512 Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote… CVSS 3.1HIGH 7.5
  • TI-2021-19709 Affected versions of Atlassian Jira Server and Data Center allow remote attackers with… CVSS 3.1HIGH 7.2
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences