CVE-2019-8442

High · 7.5

CVSS

7.5

EPSS

59.8%

Published

May 22, 2019

CISA due date

—

The record

The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.

Affected packages

Ecosystem	Package	Introduced	Fixed