All vulnerabilities
CVE-2019-11581

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Atlassian Jira Server and Data CenterApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 7 Mar 2022CISA KEV
Exploit odds (EPSS)84.6%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.6.14Also 7.13.5, 8.0.3 and 2 moreCVE List
Federal deadline7 Sep 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 7.6.14Jira Server and Data CenterCVE List
  • 7.13.5Jira Server and Data CenterCVE List
  • 8.0.3Jira Server and Data CenterCVE List
  • 8.1.2Jira Server and Data CenterCVE List
  • 8.2.3Jira Server and Data CenterCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 9 Aug 2019, 19:30 UTCPublishedCVE List
  2. 7 Mar 2022Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Scanner templateAtlassian Jira Server-Side Template InjectionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.

Text from CVE List

Affected versions 10

  • Jira Server and Data Centeraffected: 4.4.0 before unspecifiedCVE List
  • Jira Server and Data Centeraffected: unspecified before 7.6.14CVE List
  • Jira Server and Data Centeraffected: 7.7.0 before unspecifiedCVE List
  • Jira Server and Data Centeraffected: unspecified before 7.13.5CVE List
  • Jira Server and Data Centeraffected: 8.0.0 before unspecifiedCVE List
  • Jira Server and Data Centeraffected: unspecified before 8.0.3CVE List
  • Jira Server and Data Centeraffected: 8.1.0 before unspecifiedCVE List
  • Jira Server and Data Centeraffected: unspecified before 8.1.2CVE List
  • Jira Server and Data Centeraffected: 8.2.0 before unspecifiedCVE List
  • Jira Server and Data Centeraffected: unspecified before 8.2.3CVE List

References 3