QID 378988

Date Published: 2023-12-04

QID 378988: Atlassian Jira Service Management Extensible Markup Language (XML) External Entity (XXE) Injection Vulnerability (JSDSERVER-14401)

Jira Service Management is Atlassian's service management solution for all teams.

CVE-2019-13990: The affected Atlassian Jira Service Management versions contained vulnerable versions of Terracotta Quartz Scheduler which allowed authenticated attackers to initiate an XML External Entity injection attack using job descriptions.

Affected Versions: Jira Service Management versions: 4.20.0, 4.21.0, 4.20.1, 4.20.2, 4.20.3, 4.21.1, 4.20.4, 4.20.5, 4.20.6, 4.21.2, 4.20.7, 4.20.8, 4.20.9, 4.20.10, 4.20.11, 4.20.12, 4.20.13, 4.20.14, 5.4.0, 4.20.15, 5.4.1, 4.20.16, 5.5.1, 4.20.17, 5.4.2, 5.6.0, 5.4.3, 4.20.18, 5.7.0, 4.20.19, 5.4.4, 5.8.0, 4.20.20, 5.7.1, 4.20.21, 5.4.5, 4.20.22, 5.4.6, 5.8.1, 5.9.0, 4.20.23, 5.4.7, 4.20.24, 5.4.8, 5.10.0, 4.20.25, 5.4.9

QID detection Logic:
Windows: This QID checks for installed vulnerable ersion of Atlassian Jira Service Management (formerly named Jira Service Desk) by enumerating windows registries.
Linux: This QID checks for installed vulnerable version of Atlassian Jira Service Management (formerly named Jira Service Desk) using ps command.

Successful exploitation of this vulnerability allow attackers to initiate an XML External Entity injection attack using job descriptions.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
    • Solution
    Vendor has released the patch version for Jira Service Management. Customers are advised to refer to JSDSERVER-14401 for updates pertaining to this vulnerability.
    Vendor References

    CVEs related to QID 378988

    CVE-2019-13990 |
    Software Advisories
    Advisory ID Software Component Link
    JSDSERVER-14401 URL Logo jira.atlassian.com/browse/JSDSERVER-14401
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].