What is CVE-2019-10100?

CVE-2019-10100 is a critical-severity vulnerability in Jetbrains Youtrack Integration, classified under Code Injection. CVSS score: 9.8/10. Published 2019-07-03.

How severe is CVE-2019-10100?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Jetbrains Youtrack Integration

CVE-2019-10100

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jetbrains Youtrack_integration
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-10100?: CVE-2019-10100 is a critical-severity vulnerability in Jetbrains Youtrack Integration, classified under Code Injection. CVSS score: 9.8/10. Published 2019-07-03.
How severe is CVE-2019-10100?: Critical severity. CVSS v3 base score is 9.8 out of 10.