CVE-2019-11581

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 84.6%; technical severity is CVSS 9.8.

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Who should care

• Teams operating Jira Server, Jira Server and Data Center
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Jira Server, Jira Server and Data Center is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Atlassian Security advisory JRASERVER 69532
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-74

Affected versions

Atlassian Jira Server (Start Including 4.4, End Excluding 7.6.14 | Start Including 7.7.0, End Excluding 7.13.5 | Start Including 8.0.0, End Excluding 8.0.3 | Start Including 8.1.0, End Excluding 8.1.2); Atlassian Jira Server and Data Center

Fixed versions

Atlassian Jira Server (Fixed from 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3)

Published

9 August 2019

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 9 Aug 2019CVE published
2. 6 Mar 2022Added to CISA KEV
3. 19 Aug 2026Latest EPSS score: 84.6%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 83

External references

• CISA Government advisory CVE-2019-11581 ↗