{"id":"CVE-2019-8442","published":"2019-05-22T17:39:14Z","modified":"2024-09-16T17:58:53Z","title":"The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version…","vendor":"Atlassian","product":"Jira","tier":"core","eol":null,"affectedVersions":[{"vendor":"Atlassian","product":"Jira","versions":[">= unspecified, < 7.13.4",">= 8.0.0, < unspecified",">= unspecified, < 8.0.4",">= 8.1.0, < unspecified",">= unspecified, < 8.1.1"]}],"description":{"text":"The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.","provenance":"source","from":"CVE.org"},"summary":{"text":"The CachingResourceDownloadRewriteRule class in Atlassian Jira allows a path access check to be bypassed, exposing files in the Jira webroot under the META-INF directory. A remote attacker can exploit this over the network without authentication or user interaction, by requesting crafted paths that the lax check fails to block.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:21:09Z"},"cvss":null,"epss":{"score":0.59832,"percentile":0.99127,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-17","exploitedFirstSeen":"2023-11-17","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2019-8442","date":"2023-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2019-8442","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-12&host_type=src&vulnerability=cve-2019-8442","date":"2023-12-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-30&host_type=src&vulnerability=cve-2019-8442","date":"2023-12-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-06&host_type=src&vulnerability=cve-2019-8442","date":"2024-01-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-16&host_type=src&vulnerability=cve-2019-8442","date":"2024-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2019-8442","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2019-8442","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2019-8442","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2019-8442","date":"2024-01-27"}],"evidenceTotal":319,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-69241","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/108460","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-17832","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-17832","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2019-8442","name":"Jira - Local File Inclusion","severity":"high","path":"http/cves/2019/CVE-2019-8442.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-8442.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2019-05-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-8442","provenance":"source"},{"date":"2023-11-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2019-8442","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":59.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1077 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9913"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}