CVE-2010-1165

Severity: critical (CVSS 9.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-04-20 · updated 2026-06-16
Weakness: CWE-94

Description

Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010.

Affected products

Atlassian Jira: 3.12, 3.12.1, 3.12.2, 3.12.3, 3.13, 3.13.1 (+8)

References

http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16
http://jira.atlassian.com/browse/JRA-20995
http://jira.atlassian.com/browse/JRA-21004
http://secunia.com/advisories/39353
http://www.openwall.com/lists/oss-security/2010/04/16/3
http://www.openwall.com/lists/oss-security/2010/04/16/4
http://www.securityfocus.com/bid/39485
https://exchange.xforce.ibmcloud.com/vulnerabilities/57828
http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16
http://jira.atlassian.com/browse/JRA-20995
http://jira.atlassian.com/browse/JRA-21004
http://secunia.com/advisories/39353

Get alerted when CVE-2010-1165 or the next vulnerability affects your stack