Read the docs
TI-2020-11116 Aliases CVE-2020-14193GHSA-q38p-89cx-mcrc

Injection in Atlassian Automation for Jira

Priority LOW 26CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are those before version 7.1.15.

Why it matters now

EPSS 0.00779 56th percentileScored 2026-11-07
Fix Fixed Automation for Jira (Atlassian): 7.1.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianAutomation for Jirabefore 7.1.157.1.15Patch availableCNA
  • Automation for Jira VendorAtlassian Affected before 7.1.15 Fixed in 7.1.15 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:automation_for_jira:*:*:*:*:*:*:*:*before 7.1.15VulnerableAtlassian
  • cpe:2.3:a:atlassian:automation_for_jira:*:*:*:*:*:*:*:* Versions before 7.1.15 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Automation for Jira (Atlassian) Fixed in 7.1.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14193
  2. 2026-10-03 Alias added: GHSA-q38p-89cx-mcrc

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences