VULNERABILITY INTELLIGENCE

CVE-2019-20409

CVSS score9.8 CRITICAL
EPSS probability2.48%
CISA KEVNot currently listed
Published2020-06-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Weakness classification

  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Primary references