CVE-2019-11581: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
First published: Fri Aug 09 2019(Updated: )
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
Credit: security@atlassian.com security@atlassian.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atlassian JIRA | >=4.4<7.6.14 | |
| Atlassian Jira Server | >=7.7.0<7.13.5 | |
| Atlassian Jira Server | >=8.0.0<8.0.3 | |
| Atlassian Jira Server | >=8.1.0<8.1.2 | |
| Atlassian Jira Server | >=8.2.0<8.2.3 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11581?
CVE-2019-11581 is a server-side template injection vulnerability in Atlassian Jira Server and Data Center.
How does CVE-2019-11581 affect Jira Server and Data Center?
CVE-2019-11581 allows an attacker to remotely execute code on systems running a vulnerable version of Jira Server or Data Center.
What is the severity of CVE-2019-11581?
CVE-2019-11581 has a severity score of 9.8, which is classified as critical.
Which versions of Jira Server and Data Center are affected by CVE-2019-11581?
CVE-2019-11581 affects all versions of Jira Server and Data Center ranging from 4.4 to 7.6.14, 7.7.0 to 7.13.5, 8.0.0 to 8.0.3, 8.1.0 to 8.1.2, and 8.2.0 to 8.2.3.
How can I fix the CVE-2019-11581 vulnerability in Jira Server and Data Center?
To fix the CVE-2019-11581 vulnerability, it is recommended to upgrade to the latest version of Jira Server or Data Center.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/description
- agent/title
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/author
- vendor/atlassian
- canonical/atlassian jira
- version/atlassian jira/4.4
- canonical/atlassian jira server
- version/atlassian jira server/7.7.0
- version/atlassian jira server/8.0.0
- version/atlassian jira server/8.1.0
- version/atlassian jira server/8.2.0
- canonical/atlassian jira server and data center