{"id":"CVE-2019-11581","published":"2019-08-09T20:15:11Z","modified":"2026-06-17T02:13:12Z","title":"Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability","vendor":"Atlassian","product":"Jira Server and Data Center","tier":"core","eol":null,"description":{"text":"There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.","provenance":"source","from":"NVD"},"summary":{"text":"A server-side template injection flaw exists in the ContactAdministrators and SendBulkMail actions of Atlassian Jira Server and Data Center. An attacker can remotely execute code on a vulnerable Jira Server or Data Center instance over the network, without authentication or user interaction, by targeting those actions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:41Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.84621,"percentile":0.99704,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-07","dueDate":"2022-09-07","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11581","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-01-01","exploitedFirstSeen":"2021-01-01","ransomware":false,"evidence":[{"url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","date":"2021-01-01"},{"url":"https://www.lacework.com/blog/sysrv-hello-expands-infrastructure/","date":"2021-04-22"},{"url":"https://cujo.com/the-sysrv-botnet-and-how-it-evolved/","date":"2021-09-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-07"},{"url":"https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-24-PalotayZsigovits.pdf","date":"2022-04-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2019-11581","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2019-11581","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-18&host_type=src&vulnerability=cve-2019-11581","date":"2023-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2019-11581","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2019-11581","date":"2023-11-20"}],"evidenceTotal":855,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-69532","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/JRASERVER-69532","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11581","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploit of public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"remotely execute code on systems that run a vulnerable version of Jira Server","start":171,"end":248}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Template injection yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"server-side template injection vulnerability in Jira Server and Data Center","start":12,"end":87}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-f4c4ebd4090daa7d77ab","title":"____________________________________________________________________________________________________","publisher":"clearskysec.com","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","date":null,"mentions":[{"quote":"CVE-2019-11581","start":15979,"end":15993},{"quote":"• Atlassian Jira Server or Data Center (CVE-2019-11581)","start":18489,"end":18544}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-3251","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3251","exploited":true,"exploitedSince":"2022-03-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2019-07-16","earliestUrl":"https://github.com/jas502n/CVE-2019-11581","repos":[{"name":"jas502n/CVE-2019-11581","url":"https://github.com/jas502n/CVE-2019-11581","stars":93,"created":"2019-07-16"},{"name":"kobs0N/CVE-2019-11581","url":"https://github.com/kobs0N/CVE-2019-11581","stars":10,"created":"2019-07-25"},{"name":"PetrusViet/CVE-2019-11581","url":"https://github.com/PetrusViet/CVE-2019-11581","stars":6,"created":"2021-05-04"}]},"nuclei":[{"id":"CVE-2019-11581","name":"Atlassian Jira Server-Side Template Injection","severity":"critical","path":"http/cves/2019/CVE-2019-11581.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11581.yaml"}],"first":{"date":"2019-07-16","source":"PoC-in-GitHub","url":"https://github.com/jas502n/CVE-2019-11581"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-07-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/jas502n/CVE-2019-11581","provenance":"source"},{"date":"2019-08-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11581","provenance":"source"},{"date":"2021-01-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf","provenance":"source"},{"date":"2022-03-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3251","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":941},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2129 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}