CVE-2019-20409

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Jun 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-20417.3In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices due to an insecure defCVE-2019-204106.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information DisclosurCVE-2019-204114.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgCVE-2019-204125.3The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the folCVE-2019-204137.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of SCVE-2019-204145.4Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scCVE-2019-204154.3Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-siteCVE-2019-204164.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scCVE-2019-204186.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an ApplicCVE-2019-204197.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerabilitCVE-2019-204217.5In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumptioCVE-2019-204225.5In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count dec