Template Injection Vulnerability in Atlassian Jira Server and Data Center

CVE-2022-36799

What is CVE-2022-36799?

A vulnerability exists in Atlassian Jira Server and Data Center that allows remote attackers with system administrator permissions to exploit template injection vulnerabilities in the Email Templates feature. This flaw could permit the execution of arbitrary code, leading to potential remote code execution. The vulnerability arises from inadequate protection via the XStream library in velocity templates. To mitigate this issue, users are advised to upgrade to fixed versions as indicated.

References