This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the security improvement was to protect against using the XStream library to be able to execute arbitrary code in velocity templates. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.7, and from version 8.21.0 before 8.22.1.
References
| Link | Resource |
|---|---|
| https://jira.atlassian.com/browse/JRASERVER-73582 | Issue Tracking Vendor Advisory |
| https://jira.atlassian.com/browse/JRASERVER-73582 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jira.atlassian.com/browse/JRASERVER-73582 - Issue Tracking, Vendor Advisory |
05 Aug 2022, 16:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| References | (MISC) https://jira.atlassian.com/browse/JRASERVER-73582 - Issue Tracking, Vendor Advisory | |
| CWE | CWE-94 | |
| CPE | cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* |
01 Aug 2022, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-01 11:15
Updated : 2024-11-21 07:13
NVD link : CVE-2022-36799
Mitre link : CVE-2022-36799
CVE.ORG link : CVE-2022-36799
JSON object : View
Products Affected
atlassian
- jira_server
- jira_data_center
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')