CVE-2019-15001
Estado: ModificadaAlta (7.2)—
The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.2
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 11%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-94
Referencias
- http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html
- https://jira.atlassian.com/browse/JRASERVER-69933
- https://seclists.org/bugtraq/2019/Sep/42
- http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html
- https://jira.atlassian.com/browse/JRASERVER-69933
- https://seclists.org/bugtraq/2019/Sep/42
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-15001",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.2,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "security@atlassian.com",
"affectedData": [
{
"vendor": "Atlassian",
"product": "Jira Server",
"versions": [
{
"status": "affected",
"version": "7.0.10",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.6.16",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.7.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.13.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.0.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.1.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.2.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.2.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.3.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.3.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.4.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.4.1",
"versionType": "custom"
}
]
},
{
"vendor": "Atlassian",
"product": "Jira Data Center",
"versions": [
{
"status": "affected",
"version": "7.0.10",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.6.16",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.7.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.13.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.0.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.1.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.2.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.2.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.3.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.3.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "8.4.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "8.4.1",
"versionType": "custom"
}
]
}
]
}
],
"published": "2019-09-19T15:15:15.500",
"references": [
{
"url": "http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-69933",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "https://seclists.org/bugtraq/2019/Sep/42",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-69933",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://seclists.org/bugtraq/2019/Sep/42",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request."
},
{
"lang": "es",
"value": "El plugin Jira Importers en Atlassian Jira Server y Data Cente desde la versión 7.0.10 anterior a 7.6.16, desde 7.7.0 anterior a 7.13.8, desde 8.0.0 anterior a 8.1.3, desde 8.2.0 anterior a 8.2.5, desde 8.3.0 anterior a 8.3.4 y desde 8.4.0 anteriores a 8.4.1, permite a atacantes remotos con permisos de Administrador conseguir la ejecución de código remota por medio de una vulnerabilidad de inyección de plantilla mediante el uso de una petición PUT diseñada"
}
],
"lastModified": "2026-06-17T02:19:28.753",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27645527-F779-4D88-A5DC-3889826057F8",
"versionEndExcluding": "7.6.16",
"versionStartIncluding": "7.0.10"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5713AA6-6A8E-4047-A2BB-F3DD86F4027F",
"versionEndExcluding": "7.13.8",
"versionStartIncluding": "7.7.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "619C9169-030E-4DFA-980B-579C7BEE92EA",
"versionEndExcluding": "8.1.3",
"versionStartIncluding": "8.0.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19D84658-E0FE-46A1-8632-E82A617B424C",
"versionEndExcluding": "8.2.5",
"versionStartIncluding": "8.2.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CCF9D19-3053-4B57-AE4F-462F26CB7488",
"versionEndExcluding": "8.3.4",
"versionStartIncluding": "8.3.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:8.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D45212C3-E178-40D9-B3EF-2738A879A345"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1099688C-6260-4216-83C9-29ED1347FC9C",
"versionEndExcluding": "7.6.16",
"versionStartIncluding": "7.0.10"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "03E27B59-BCEA-433E-94AF-81125454834F",
"versionEndExcluding": "7.13.8",
"versionStartIncluding": "7.7.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AE27B6F-A8A0-4083-8F80-60D3AD0DBAB5",
"versionEndExcluding": "8.1.3",
"versionStartIncluding": "8.0.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "221A13F3-D7C3-4F70-B6C6-375B77153C6E",
"versionEndExcluding": "8.2.5",
"versionStartIncluding": "8.2.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0D36CAF-2183-4989-BB31-6EFA15AD6372",
"versionEndExcluding": "8.3.4",
"versionStartIncluding": "8.3.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_data_center:8.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93D2C7F2-FA9A-471B-8B98-F4089E68ABA7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@atlassian.com"
}