CVE-2019-11581

CRITICALCISA KEV

9.8

Description

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie8/9/2019

Derniere modification10/24/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurAtlassian

ProduitJira Server and Data Center

Nom vulnerabiliteAtlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Date ajout KEV2022-03-07

Date limite remediation2022-09-07

Utilise dans ransomwareUnknown

Produits affectes

atlassian:jira_server

Faiblesses (CWE)

CWE-74CWE-74

References

https://jira.atlassian.com/browse/JRASERVER-69532(security@atlassian.com)

https://jira.atlassian.com/browse/JRASERVER-69532(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11581(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.