According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. It is, therefore, affected by a vulnerability allowing remote attackers with administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. 因此，它會受到多個弱點影響：

 - 可在電子郵件範本功能中導致遠端程式碼執行的範本插入，允許具有管理員權限的遠端攻擊者執行任意程式碼。

 - /rest/collectors/1.0/template/custom 端點中有一個反映式跨網站指令碼 (XSS) 弱點，允許遠端攻擊者插入任意 HTML 或 JavaScript。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. 因此，它會受到多個弱點影響：

 - 可在電子郵件範本功能中導致遠端程式碼執行的範本插入，允許具有管理員權限的遠端攻擊者執行任意程式碼。

 - /rest/collectors/

根據其自我報告的版本號碼，遠端 Web 伺服器上主控的 Atlassian Jira 執行個體受到其電子郵件範本功能中一個遠端程式碼執行弱點的影響。經驗證的遠端攻擊者可惡意利用此弱點，繞過驗證並執行任意命令。 

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
113281	Atlassian Jira < 8.13.15 Template Injection	Web App Scanning	Component Vulnerability	2022/7/8	2023/3/14	high
113271	Atlassian Jira < 8.13.15 多個弱點	Web App Scanning	Component Vulnerability	2022/7/8	2023/3/14	high
113272	Atlassian Jira 8.14.x < 8.20.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2022/7/8	2023/3/14	high
113282	Atlassian Jira 8.14.x < 8.20.3 Template Injection	Web App Scanning	Component Vulnerability	2022/7/8	2023/3/14	high
157176	Atlassian Jira < 8.13.15 / 8.14.0 < 8.20.3 RCE (JRASERVER-73067)	Nessus	CGI abuses	2022/1/28	2022/4/29	high

偵測

搜尋 Plugin

high

high

high

high

high