We are on Jira Server Enterprise version 7.6.7 and hosted on windows server.
As temporary workaround, the "Contact Administrator's form" is already in OFF and the context path is blank. So, do should i still have to make changes?
if yes, is the below will context path code is ok to use? because i do not see "SendBulkMail!default.jspa" in the mentioned location but seeing SendBulkMail.jsp. Please suggest.
<Context path="D:\Atlassian760\JIRA\atlassian-jira\secure\admin\views\mail\SendBulkMail!default.jspa" docBase="" >
<Valapp className="org.apache.catalina.valapps.RemoteAddrValapp" deny="*" />
</Context>
Based on the Template Injection Vulnerability,
https://community.atlassian.com/t5/Jira-articles/CVE-2019-11581-Critical-Security-Advisory-for-Jira-Server-and/ba-p/1128241
