CVE-2008-6531 Code injection in n/a
Remote attackers can execute arbitrary code in Atlassian JIRA by crafting URLs that invoke exposed public methods via WebWork parameter injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-6531?
CVE-2008-6531 is a medium-severity code injection vulnerability in Atlassian Jira, published on 26 Mar 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."
Weakness: CWE-94
Which versions are affected by CVE-2008-6531?
It affects 1 product.
Products include Atlassian Jira.
How do I fix CVE-2008-6531?
No fix has been published for CVE-2008-6531 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2008-6531 being exploited?
There is no known exploitation of CVE-2008-6531 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Jira
Sources
Also known as GHSA-99qg-2w8q-6fqv.