The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
https://marketplace.atlassian.com/apps/43318/power-scripts-jira-script-automation/version-history | release notes vendor advisory |
https://www.detack.de/en/cve-2019-9005 | third party advisory exploit |