CVE-2019-10100 - CVE House
Back to Database
Status published Critical CVE-2019-10100

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was...

Vulnerability Description

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10100

Credits & Attribution

No credits recorded in the NVD database.

References

More from jetbrains

View All →
CVE-2022-25264
In JetBrains TeamCity before 2021.2.3, environment variables of the "password"...
High 7.5
CVE-2022-25263
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection...
Critical 9.8
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible....
Critical 9.8
CVE-2022-25261
JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS....
Medium 6.1
CVE-2022-25260
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request...
Critical 9.1

Affected Vendor

Affected Software

youtrack integration
Vulnerable Versions:
0

Timeline

Official Publish: July 3rd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.