PT-2020-10436 · Apache+1 · Apache Tomcat+1

Published 2020-07-03 · Updated 2022-07-27 · CVE-2019-20419

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.5.5 Atlassian Jira Server and Data Center versions 8.6.0 through 8.7.2

Description The issue allows remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat.

Recommendations For versions prior to 8.5.5, update to version 8.5.5 or later. For versions 8.6.0 through 8.7.2, update to version 8.7.2 or later. As a temporary workaround, consider restricting access to the Tomcat server to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2019-20419

Affected Products

Jira

Apache Tomcat

References · 5

• https://osv.dev/vulnerability/CVE-2019-20419 · Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-70945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20419 · Security Note
• https://t.me/cibsecurity/13234 · Telegram Post
• https://t.me/cvenotify/4840 · Telegram Post