Back
CVE-2019-11581
CRITICAL
CISA KEV
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
Published: Aug 9, 2019
Modified: Jun 17, 2026
CWE-74
CWE-74
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (5)
| Vendor | Product | Version |
|---|---|---|
| atlassian | jira_server | * ≥ 4.4 < 7.6.14 |
| atlassian | jira_server | * ≥ 7.7.0 < 7.13.5 |
| atlassian | jira_server | * ≥ 8.0.0 < 8.0.3 |
| atlassian | jira_server | * ≥ 8.1.0 < 8.1.2 |
| atlassian | jira_server | * ≥ 8.2.0 < 8.2.3 |
GitHub Security Advisory GHSA-55hv-x43w-phcv
There was a server-side template injection vulnerability in Jira Server and Data Center, in the...
References (3)
- https://jira.atlassian.com/browse/JRASERVER-69532 Issue Tracking, Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-69532 Issue Tracking, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11581 US Government Resource
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
84.62%
Top 0% most likely to be exploited
Threat Score
94.6 / 100
CISA Known Exploited
Date Added:
2022-03-07
Due Date:
2022-09-07
Required Action:
Apply updates per vendor instructions.
Data Sources
NVD
CISA KEV
EPSS
GitHub