Note: the current version of this advisory can be found at https://confluence.atlassian.com/x/IcBKLg . CVE ID: CVE-2015-5603 Product: JIRA and the HipChat for JIRA plugin. Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0 Affected JIRA product versions: 6.3.5 <= version < 6.4.11 Summary: This advisory discloses a critical severity security vulnerability that was introduced in version 1.3.2 of the HipChat for JIRA plugin. Versions of the HipChat for JIRA plugin starting with 1.3.2 before 6.30.0 (the fixed version) are vulnerable. Vulnerable versions of the HipChat for JIRA plugin were bundled by default with JIRA since JIRA version 6.3.5, up to but not including 6.4.11 (the fixed version). Atlassian Cloud instances have already been upgraded to a version of the HipChat for JIRA plugin which does not have the issue described in this email. Customers who have updated the HipChat For JIRA plugin to version 6.30.0 or higher are not affected. Customers who have downloaded and installed JIRA >= 6.3.5 < 6.4.11 and have not updated the HipChat For JIRA plugin to 6.30.0 or higher should either update those instances of the HipChat For JIRA plugin for their JIRA installations in order to fix this vulnerability. Customers who have installed the HipChat For JIRA plugin in JIRA, and are running a version of the plugin equal to or above 1.3.2 and less than 6.30.0 should either update those instances of the HipChat For JIRA plugin or their JIRA installations to fix this vulnerability. Severity: Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels (https://www.atlassian.com/security/security-severity-levels). The scale allows us to rank a severity as critical, high, moderate, or low. This is an independent assessment and you should evaluate its applicability to your own IT environment. Description: We internally discovered that the HipChat For JIRA plugin had a resource that combined user input into a velocity template source and subsequently rendered it. Authenticated attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of the HipChat For JIRA plugin enabled. To exploit this issue attackers need to be able to access the JIRA web interface and log into JIRA. All versions of HipChat For JIRA plugin from 1.3.2 before 6.30.0 are affected by this vulnerability. All versions of JIRA from 6.3.5 before 6.4.11 are affected by this vulnerability. This issue can be tracked here: https://jira.atlassian.com/browse/JRA-44831 Fix: We have taken the follow steps to address this issue: Released a new version, 6.30.0, of the HipChat For JIRA plugin Released JIRA version 6.4.11 that updates the bundled copy of the HipChat For JIRA plugin to a fixed version. Remediation: Upgrade the HipChat for JIRA plugin to version 6.30.0 or higher. For instructions on how to update add-ons like the HipChat For JIRA plugin see https://confluence.atlassian.com/display/UPM/Updating+add-ons. Optionally upgrade JIRA to version 6.4.11 which bundles a fixed version of the HipChat For JIRA plugin. Risk Mitigation: If you are unable to upgrade your JIRA server or the HipChat for JIRA plugin, then as a temporary workaround, you can disable or uninstall the HipChat For JIRA plugin in JIRA. Support: If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/ . -- David Black / Security Engineer.