Atlassian · Jira Server and Data Center
CVE-2019-11581
Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
What it is
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
CISA: Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: September 7, 2022
- Added to the CISA list
- March 7, 2022
- Published
- August 9, 2019
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 85% in the top 0.3% of all known vulnerabilities
- Weakness
- CWE-74
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Atlassian
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 12, 2024 | Path Traversal | Jira Server and Data Center | Medium 5.3 | >99.9% |
| Oct 15, 2026 | Files or Directories Accessible to External Parties | Multiple Products | Critical 9.3 | 99.5% |
| Jan 24, 2024 | Template Injection | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Nov 7, 2023 | Improper Authorization | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Oct 5, 2023 | Broken Access Control | Confluence Data Center and Server | Critical 10.0 | 99.2% |
| Sep 30, 2022 | Command Injection | Bitbucket Server and Data Center | High 8.8 | 99.1% |
| Jul 29, 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Critical 9.8 | 98% |
| Jun 2, 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.