CVE-2019-11581 - There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions

Back Back to CVE browser

CRITICAL KEV

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions

Published Aug 9, 2019 ·Due Sep 7, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 84.62%

Description

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Affected products

Vendor Atlassian Product Jira Server and Data Center Default
n/a
- Version
  4.4.0
  Status
  affected
  Constraints
  <unspecified
- Version
  7.7.0
  Status
  affected
  Constraints
  <unspecified
- Version
  8.0.0
  Status
  affected
  Constraints
  <unspecified
- Version
  8.1.0
  Status
  affected
  Constraints
  <unspecified
- Version
  8.2.0
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <7.13.5
- Version
  unspecified
  Status
  affected
  Constraints
  <7.6.14
- Version
  unspecified
  Status
  affected
  Constraints
  <8.0.3
- Version
  unspecified
  Status
  affected
  Constraints
  <8.1.2
- Version
  unspecified
  Status
  affected
  Constraints
  <8.2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Atlassian

Jira Server and Data Center

n/a

Version	Status	Constraints
4.4.0	affected	<unspecified
7.7.0	affected	<unspecified
8.0.0	affected	<unspecified
8.1.0	affected	<unspecified
8.2.0	affected	<unspecified
unspecified	affected	<7.13.5
unspecified	affected	<7.6.14
unspecified	affected	<8.0.3
unspecified	affected	<8.1.2
unspecified	affected	<8.2.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (2)

https://jira.atlassian.com/browse/JRASERVER-69532
x_refsource_MISCIssue TrackingVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11581
government-resourceUS Government Resource

Link	Providers	Tags
https://jira.atlassian.com/browse/JRASERVER-69532		x_refsource_MISCIssue TrackingVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11581		government-resourceUS Government Resource