9.8

CVE-2019-11580: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

KEVRansomware
Analyzed
Published 03-06-2019Last modified 21-10-2025

Vulnerability summary

CVE-2019-11580 is a critical (CVSS 9.8) vulnerability in Atlassian Crowd and Crowd Data Center. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 95.36% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Act nowransomware

Known ransomware use (CISA, 03-11-2021)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
95.36%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareKnown useFlagged by CISA
Public exploits2reference, metasploit

Timeline

  1. 03-06-2019
    PublishedVulnerability first disclosed.
  2. 03-11-2021
    Added to CISA KEVExploitedAtlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability
  3. 03-05-2022
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

95.36%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 95.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
03-11-2021
Federal due date
03-05-2022
Ransomware
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-11580

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • MetasploitMetasploitremoteVerified

    Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE

    exploit/multi/http/atlassian_crowd_pdkinstall_plugin_upload_rce

    Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian1 product
  • crowd≥ 2.1.0, < unspecified | ≥ unspecified, < 3.0.5 | ≥ 3.1.0, < unspecified | ≥ unspecified, < 3.1.6 | ≥ 3.2.0, < unspecified | ≥ unspecified, < 3.2.8 | ≥ 3.3.0, < unspecified | ≥ unspecified, < 3.3.5 | ≥ 3.4.0, < unspecified | ≥ unspecified, < 3.4.4 | ≥ 2.1.0, < 3.0.5 | ≥ 3.1.0, < 3.1.6 | ≥ 3.2.0, < 3.2.8 | ≥ 3.3.0, < 3.3.5 | ≥ 3.4.0, < 3.4.4

1 vendor · 1 product

References

4 links