Log in Start free

Actively exploited · Published Aug 9, 2019 · Assigned by atlassian

CVE-2019-11581

Critical 9.8 Exploited

In plain English

A critical-severity injection in Jira Server and Data Center from Atlassian. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2022). The chance it is exploited in the next 30 days is estimated at 84.6% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)84.6%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Mar 7, 2022
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 7, 2022.

Official description

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Affected products (as reported)

VendorProductVersions
Atlassian Jira Server and Data Center 4.4.0 – before unspecifiedunspecified – before 7.6.147.7.0 – before unspecifiedunspecified – before 7.13.58.0.0 – before unspecifiedunspecified – before 8.0.38.1.0 – before unspecifiedunspecified – before 8.1.2

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References