Template Injection Vulnerability in Multiple Versions of Jira Server and Data Center

[Ramesh Kagitha]

We are on Jira Server Enterprise version 7.6.7 and hosted on windows server.

As temporary workaround, the "Contact Administrator's form" is already in OFF and the context path is blank. So, do should i still have to make changes?

if yes, is the below will context path code is ok to use? because i do not see "SendBulkMail!default.jspa" in the mentioned location but seeing SendBulkMail.jsp. Please suggest.

<Context path="D:\Atlassian760\JIRA\atlassian-jira\secure\admin\views\mail\SendBulkMail!default.jspa" docBase="" >
<Valapp className="org.apache.catalina.valapps.RemoteAddrValapp" deny="*" />
</Context>

Based on the Template Injection Vulnerability, 

https://community.atlassian.com/t5/Jira-articles/CVE-2019-11581-Critical-Security-Advisory-for-Jira-Server-and/ba-p/1128241

[JP _AC Bielefeld Leader_]

Hi,

not sure, if the context path accepts a backslash as path separators. I use forward slashes...

Best

JP