Vulnerability Description
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jetbrains | Youtrack Integration | < 1.8.1.3 |
Related Weaknesses (CWE)
References
- https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/Vendor Advisory
- https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/Vendor Advisory
FAQ
What is CVE-2019-10100?
CVE-2019-10100 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a c...
How severe is CVE-2019-10100?
CVE-2019-10100 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-10100?
Check the references section above for vendor advisories and patch information. Affected products include: Jetbrains Youtrack Integration.