PT-2021-8571 · Atlassian · Jira

Published 2021-08-02 · Updated 2024-10-17 · CVE-2017-18113

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jira Server and Jira Data Center versions prior to 8.18.1

Description The issue allows remote attackers to execute arbitrary code via a Remote Code Execution (RCE) vulnerability, by tricking a system administrator into importing a malicious workflow. This is possible due to the usage of various problematic OSWorkflow classes as part of workflows. The fix for this issue blocks the usage of unsafe conditions, validators, functions, and registers built into the OSWorkflow library and other Jira dependencies. It is noted that Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix.

Recommendations For versions prior to 8.18.1, update to version 8.18.1 or later to resolve the issue. As a temporary workaround, consider restricting the import of workflows to trusted sources until the update is applied.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-18113

Affected Products

Jira

References · 4

• https://jira.atlassian.com/browse/JRASERVER-72660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18113 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18113 · Vendor Advisory
• https://t.me/cvenotify/98542 · Telegram Post