All vulnerabilities
CVE-2019-11580

Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

Atlassian Crowd and Crowd Data Center
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 3 Nov 2021. Known ransomware useCISA KEV
Exploit odds (EPSS)95.4%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.0.5Also 3.1.6, 3.2.8 and 2 moreCVE List
Federal deadline3 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 22 May 2019Exploit code publicMetasploit
  2. 3 Jun 2019, 13:43 UTCPublishedCVE List
  3. 3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleAtlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE 22 May 2019Metasploit
  • Scanner templateAtlassian Crowd and Crowd Data Center - Unauthenticated Remote Code ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.

Text from CVE List

Affected versions 10

  • Crowdaffected: 2.1.0 before unspecifiedCVE List
  • Crowdaffected: unspecified before 3.0.5CVE List
  • Crowdaffected: 3.1.0 before unspecifiedCVE List
  • Crowdaffected: unspecified before 3.1.6CVE List
  • Crowdaffected: 3.2.0 before unspecifiedCVE List
  • Crowdaffected: unspecified before 3.2.8CVE List
  • Crowdaffected: 3.3.0 before unspecifiedCVE List
  • Crowdaffected: unspecified before 3.3.5CVE List
  • Crowdaffected: 3.4.0 before unspecifiedCVE List
  • Crowdaffected: unspecified before 3.4.4CVE List

References 3