Read the docs
TI-2019-11187 Aliases CVE-2019-15001GHSA-v4p4-65gh-94f7

Code injection in Atlassian Jira Server

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.

Why it matters now

EPSS 0.10998 95th percentileScored 2026-11-07
Fix Fixed Jira Server (Atlassian): 7.6.16, 7.13.8, 8.1.3 +3Jira Data Center (Atlassian): 7.6.16, 7.13.8, 8.1.3 +3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Server7.0.10 and later; before 7.6.16; 7.7.0 and later; before 7.13.8; 8.0.0 and later; before 8.1.3; 8.2.0 and later; before 8.2.5; 8.3.0 and later; before 8.3.4; 8.4.0 and later; before 8.4.17.6.16, 7.13.8, 8.1.3, 8.2.5, 8.3.4, 8.4.1Patch availableCNA
AtlassianJira Data Center7.0.10 and later; before 7.6.16; 7.7.0 and later; before 7.13.8; 8.0.0 and later; before 8.1.3; 8.2.0 and later; before 8.2.5; 8.3.0 and later; before 8.3.4; 8.4.0 and later; before 8.4.17.6.16, 7.13.8, 8.1.3, 8.2.5, 8.3.4, 8.4.1Patch availableCNA
  • Jira Server VendorAtlassian Affected 7.0.10 and later; before 7.6.16; 7.7.0 and later; before 7.13.8; 8.0.0 and later; before 8.1.3; 8.2.0 and later; before 8.2.5; 8.3.0 and later; before 8.3.4; 8.4.0 and later; before 8.4.1 Fixed in 7.6.16, 7.13.8, 8.1.3, 8.2.5, 8.3.4, 8.4.1 Patch available CNA
  • Jira Data Center VendorAtlassian Affected 7.0.10 and later; before 7.6.16; 7.7.0 and later; before 7.13.8; 8.0.0 and later; before 8.1.3; 8.2.0 and later; before 8.2.5; 8.3.0 and later; before 8.3.4; 8.4.0 and later; before 8.4.1 Fixed in 7.6.16, 7.13.8, 8.1.3, 8.2.5, 8.3.4, 8.4.1 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*7.0.10 to before 7.6.16; 7.7.0 to before 7.13.8; 8.0.0 to before 8.1.3; 8.2.0 to before 8.2.5; 8.3.0 to before 8.3.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_server:8.4.0:*:*:*:*:*:*:*8.4.0VulnerableAtlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*7.0.10 to before 7.6.16; 7.7.0 to before 7.13.8; 8.0.0 to before 8.1.3; 8.2.0 to before 8.2.5; 8.3.0 to before 8.3.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_data_center:8.4.0:*:*:*:*:*:*:*8.4.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 7.0.10 to before 7.6.16; 7.7.0 to before 7.13.8; 8.0.0 to before 8.1.3; 8.2.0 to before 8.2.5; 8.3.0 to before 8.3.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_server:8.4.0:*:*:*:*:*:*:* Versions 8.4.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 7.0.10 to before 7.6.16; 7.7.0 to before 7.13.8; 8.0.0 to before 8.1.3; 8.2.0 to before 8.2.5; 8.3.0 to before 8.3.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_data_center:8.4.0:*:*:*:*:*:*:* Versions 8.4.0 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Server (Atlassian) Fixed in 7.6.16, 7.13.8, 8.1.3, 8.2.5, 8.3.4, 8.4.1
  • Fix · CNA Jira Data Center (Atlassian) Fixed in 7.6.16, 7.13.8, 8.1.3, 8.2.5, 8.3.4, 8.4.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15001
  2. 2026-10-03 Alias added: GHSA-v4p4-65gh-94f7

References

Advisory 3

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2022-00460 Improper authentication in Atlassian Jira Core Server CVSS 3.1CRITICAL 9.8
  • TI-2024-14399 Code injection in Atlassian Confluence Data Center CVSS 3.1HIGH 8.8
  • TI-2021-08038 Path traversal in Atlassian Jira Server KEVCVSS 3.1MEDIUM 5.3
  • TI-2020-18559 Missing authorization in Atlassian Jira Data Center CVSS 3.1CRITICAL 9.8
  • TI-2020-18587 Incorrect authorization in Atlassian Jira Server CVSS 3.1MEDIUM 5.3
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences