CVE-2015-5603

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Atlassian HipChat for Jira Plugin - Velocity Template Injection (Metasploit)2015-12-08 · remote · multiple · Verified
• JIRA and HipChat for JIRA Plugin - Velocity Template Injection2015-10-28 · webapps · java · Verified

Impact

The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.html
• http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_template
• http://www.securityfocus.com/archive/1/536374/100/0/threaded
• https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
• https://www.exploit-db.com/exploits/38551/
• https://www.exploit-db.com/exploits/38905/
• http://packetstormsecurity.com/files/133401/Jira-HipChat-For-Jira-Java-Code-Execution.html
• http://www.rapid7.com/db/modules/exploit/multi/http/jira_hipchat_template
• http://www.securityfocus.com/archive/1/536374/100/0/threaded
• https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
• https://www.exploit-db.com/exploits/38551/
• https://www.exploit-db.com/exploits/38905/