Description
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Jira Server and Data Center | 4.4.0 – < unspecified, unspecified – < 7.6.14, 7.7.0 – < unspecified, unspecified – < 7.13.5, 8.0.0 – < unspecified, unspecified – < 8.0.3, 8.1.0 – < unspecified, unspecified – < 8.1.2, 8.2.0 – < unspecified, unspecified – < 8.2.3 | unspecified |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
jas502n/CVE-2019-11581 ★ 93 · Jul 16, 2019
Atlassian JIRA Template injection vulnerability RCE
-
kobs0N/CVE-2019-11581 ★ 10 · Jul 25, 2019
CVE-2019–11581 PoC
-
PetrusViet/CVE-2019-11581 ★ 6 · May 4, 2021
Atlassian Jira unauthen template injection
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Atlassian Jira Server-Side Template Injection http/cves/2019/CVE-2019-11581.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.