9.8

CVE-2019-11581: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

KEV
Analyzed
Published 09-08-2019Last modified 21-10-2025

Vulnerability summary

CVE-2019-11581 is a critical (CVSS 9.8) vulnerability in Atlassian Jira Server and Data Center. It is known to be exploited: CISA lists it, first on 07-03-2022. EPSS estimates a 84.62% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Priority
Act nowlisted as exploited

Listed as exploited by CISA (07-03-2022)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
84.62%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 09-08-2019
    PublishedVulnerability first disclosed.
  2. 07-03-2022
    Added to CISA KEVExploitedAtlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
  3. 07-09-2022
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

84.62%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 84.62% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
07-03-2022
Federal due date
07-09-2022
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-11581

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products
  • jira_server≥ 4.4, < 7.6.14 | ≥ 7.7.0, < 7.13.5 | ≥ 8.0.0, < 8.0.3 | ≥ 8.1.0, < 8.1.2 | ≥ 8.2.0, < 8.2.3
  • jira_server_and_data_center≥ 4.4.0, < unspecified | ≥ unspecified, < 7.6.14 | ≥ 7.7.0, < unspecified | ≥ unspecified, < 7.13.5 | ≥ 8.0.0, < unspecified | ≥ unspecified, < 8.0.3 | ≥ 8.1.0, < unspecified | ≥ unspecified, < 8.1.2 | ≥ 8.2.0, < unspecified | ≥ unspecified, < 8.2.3

1 vendor · 2 products

References

2 links