CVE-2019-8442

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.

7.5

CVSS

59.8%

EPSS (exploit prob.)

99th

EPSS percentile

2019-05-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Affected versions
atlassian	jira	< 7.13.4
atlassian	jira_server	>= 8.0.0, < 8.0.4
atlassian	jira_server	>= 8.1.0, < 8.1.1

Check a specific version with /api/v1/cve/match.

References

http://www.securityfocus.com/bid/108460
https://jira.atlassian.com/browse/JRASERVER-69241
http://www.securityfocus.com/bid/108460
https://jira.atlassian.com/browse/JRASERVER-69241

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-8442