We internally discovered that the HipChat For JIRA plugin had a resource that combined user input into a velocity template source and subsequently rendered it. Authenticated attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of the HipChat For JIRA plugin enabled. To exploit this issue attackers need to be able to access the JIRA web interface and log into JIRA. Vulnerable versions of the HipChat for JIRA plugin were bundled by default with JIRA since JIRA version 6.3.5, up to but not including 6.4.11 (the fixed version).

Affected versions:

• All versions of HipChat For JIRA plugin from 1.3.2 before 6.30.0 are affected by this vulnerability.
• All versions of JIRA from 6.3.5 before 6.4.11 are affected by this vulnerability.

Fix:

• The HipChat for JIRA plugin can be updated through JIRA's addon manager. For instructions on how to update the HipChat For JIRA plugin see https://confluence.atlassian.com/display/UPM/Updating+add-ons.
• JIRA Server 6.4.11 is available for download from https://www.atlassian.com/software/jira/download.

Risk Mitigation:

• If you are unable to upgrade your JIRA server, then as a temporary workaround, you can disable or uninstall the HipChat For JIRA plugin in JIRA.

For additional details see the full advisory.