CVE-2019-11581

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

*SSVC

Descriptions

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Se presentó una vulnerabilidad de inyección de plantilla en el lado del servidor en Jira Server y Data Center, en las acciones ContactAdministrators y SendBulkMail. Un atacante puede ejecutar código remotamente sobre sistemas que ejecutan una versión vulnerable de Jira Server o Data Center. Todas las versiones de Jira Server y Data Center desde 4.4.0 anteriores a 7.6.14, desde 7.7.0 anteriores a 7.13.5, desde 8.0.0 anteriores a 8.0.3, desde 8.1.0 anteriores a 8.1.2 y desde 8.2.0 anteriores a 8.2.3, están afectados por esta vulnerabilidad.

Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-04-29 CVE Reserved
2019-07-22 First Exploit
2019-07-23 CVE Published
2022-03-07 Exploited in Wild
2022-09-07 KEV Due Date
2024-09-16 CVE Updated
2024-09-17 EPSS Updated

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC
https://github.com/jas502n/CVE-2019-11581	2019-07-22
https://github.com/kobs0N/CVE-2019-11581	2019-12-13
https://github.com/PetrusViet/CVE-2019-11581	2021-11-29

URL	Date	SRC

URL	Date	SRC
https://jira.atlassian.com/browse/JRASERVER-69532	2022-03-25

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Atlassian Search vendor "Atlassian"		Jira Search vendor "Atlassian" for product "Jira"				>= 4.4 < 7.6.14 Search vendor "Atlassian" for product "Jira" and version " >= 4.4 < 7.6.14"		-		Affected
Atlassian Search vendor "Atlassian"		Jira Server Search vendor "Atlassian" for product "Jira Server"				>= 7.7.0 < 7.13.5 Search vendor "Atlassian" for product "Jira Server" and version " >= 7.7.0 < 7.13.5"		-		Affected
Atlassian Search vendor "Atlassian"		Jira Server Search vendor "Atlassian" for product "Jira Server"				>= 8.0.0 < 8.0.3 Search vendor "Atlassian" for product "Jira Server" and version " >= 8.0.0 < 8.0.3"		-		Affected
Atlassian Search vendor "Atlassian"		Jira Server Search vendor "Atlassian" for product "Jira Server"				>= 8.1.0 < 8.1.2 Search vendor "Atlassian" for product "Jira Server" and version " >= 8.1.0 < 8.1.2"		-		Affected
Atlassian Search vendor "Atlassian"		Jira Server Search vendor "Atlassian" for product "Jira Server"				>= 8.2.0 < 8.2.3 Search vendor "Atlassian" for product "Jira Server" and version " >= 8.2.0 < 8.2.3"		-		Affected