The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jira | Atlassian | 4.2.4 (including) | 4.2.4 (including) |
| Jira | Atlassian | 4.3 (including) | 4.3 (including) |
| Jira | Atlassian | 4.3.1 (including) | 4.3.1 (including) |
| Jira | Atlassian | 4.3.2 (including) | 4.3.2 (including) |
| Jira | Atlassian | 4.3.3 (including) | 4.3.3 (including) |
| Jira | Atlassian | 4.3.4 (including) | 4.3.4 (including) |
| Jira | Atlassian | 4.4 (including) | 4.4 (including) |
| Jira | Atlassian | 4.4.1 (including) | 4.4.1 (including) |
| Jira | Atlassian | 4.4.2 (including) | 4.4.2 (including) |
| Jira | Atlassian | 4.4.3 (including) | 4.4.3 (including) |
| Jira | Atlassian | 4.4.4 (including) | 4.4.4 (including) |
| Jira | Atlassian | 4.4.5 (including) | 4.4.5 (including) |
| Jira | Atlassian | 5.0 (including) | 5.0 (including) |
| Jira | Atlassian | 5.0.1 (including) | 5.0.1 (including) |
| Jira | Atlassian | 5.0.2 (including) | 5.0.2 (including) |
| Jira | Atlassian | 5.0.3 (including) | 5.0.3 (including) |
| Jira | Atlassian | 5.0.4 (including) | 5.0.4 (including) |
| Jira | Atlassian | 5.0.5 (including) | 5.0.5 (including) |
| Jira | Atlassian | 5.0.7 (including) | 5.0.7 (including) |
| Jira | Atlassian | 5.1 (including) | 5.1 (including) |
| Jira | Atlassian | 5.1.1 (including) | 5.1.1 (including) |
| Jira | Atlassian | 5.1.2 (including) | 5.1.2 (including) |
| Jira | Atlassian | 5.1.3 (including) | 5.1.3 (including) |
| Jira | Atlassian | 5.1.4 (including) | 5.1.4 (including) |
| Jira | Atlassian | 5.1.5 (including) | 5.1.5 (including) |
| Jira | Atlassian | 5.1.6 (including) | 5.1.6 (including) |
| Jira | Atlassian | 5.1.7 (including) | 5.1.7 (including) |
| Jira | Atlassian | 5.1.8 (including) | 5.1.8 (including) |
| Jira | Atlassian | 5.2 (including) | 5.2 (including) |
| Jira | Atlassian | 5.2.1 (including) | 5.2.1 (including) |
| Jira | Atlassian | 5.2.2 (including) | 5.2.2 (including) |
| Jira | Atlassian | 5.2.3 (including) | 5.2.3 (including) |
| Jira | Atlassian | 5.2.4 (including) | 5.2.4 (including) |
| Jira | Atlassian | 5.2.5 (including) | 5.2.5 (including) |
| Jira | Atlassian | 5.2.6 (including) | 5.2.6 (including) |
| Jira | Atlassian | 5.2.7 (including) | 5.2.7 (including) |
| Jira | Atlassian | 5.2.8 (including) | 5.2.8 (including) |
| Jira | Atlassian | 5.2.9 (including) | 5.2.9 (including) |
| Jira | Atlassian | 5.2.10 (including) | 5.2.10 (including) |
| Jira | Atlassian | 5.2.11 (including) | 5.2.11 (including) |
| Jira | Atlassian | 6.0 (including) | 6.0 (including) |
| Jira | Atlassian | 6.0.1 (including) | 6.0.1 (including) |
| Jira | Atlassian | 6.0.2 (including) | 6.0.2 (including) |
| Jira | Atlassian | 6.0.3 (including) | 6.0.3 (including) |
| Jira | Atlassian | 6.0.4 (including) | 6.0.4 (including) |
| Jira | Atlassian | 6.0.5 (including) | 6.0.5 (including) |
| Jira | Atlassian | 6.0.7 (including) | 6.0.7 (including) |
| Jira | Atlassian | 6.0.8 (including) | 6.0.8 (including) |
| Jira | Atlassian | 6.1 (including) | 6.1 (including) |
| Jira | Atlassian | 6.1.1 (including) | 6.1.1 (including) |
| Jira | Atlassian | 6.1.2 (including) | 6.1.2 (including) |
| Jira | Atlassian | 6.1.3 (including) | 6.1.3 (including) |
| Jira | Atlassian | 6.1.4 (including) | 6.1.4 (including) |
| Jira | Atlassian | 6.1.5 (including) | 6.1.5 (including) |
| Jira | Atlassian | 6.1.6 (including) | 6.1.6 (including) |
| Jira | Atlassian | 6.1.7 (including) | 6.1.7 (including) |
| Jira | Atlassian | 6.1.8 (including) | 6.1.8 (including) |
| Jira | Atlassian | 6.1.9 (including) | 6.1.9 (including) |
| Jira | Atlassian | 6.2 (including) | 6.2 (including) |
| Jira | Atlassian | 6.2.1 (including) | 6.2.1 (including) |
| Jira | Atlassian | 6.2.2 (including) | 6.2.2 (including) |
| Jira | Atlassian | 6.2.3 (including) | 6.2.3 (including) |
| Jira | Atlassian | 6.2.4 (including) | 6.2.4 (including) |
| Jira | Atlassian | 6.2.5 (including) | 6.2.5 (including) |
| Jira | Atlassian | 6.2.6 (including) | 6.2.6 (including) |
| Jira | Atlassian | 6.2.7 (including) | 6.2.7 (including) |