CVEvulnerability

CVE-2019-10100

9.8 CRITICAL Published 2019-07-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-07-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-94

Description

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.

Affected configurations

• jetbrains youtrack integration (< 1.8.1.3)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References