CVE-2019-11581 Atlassian Jira Server and Data Center Server-Side Template Injection
Remote attackers can execute arbitrary code on Jira Server or Data Center via server-side template injection in mail actions.
- Exploited in the wild
- Since 7 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11581?
CVE-2019-11581 is a critical code injection vulnerability in Atlassian Jira Server, published on 9 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
Weakness: CWE-74
Which versions are affected by CVE-2019-11581?
It affects 1 product.
Products include Atlassian Jira Server.
How do I fix CVE-2019-11581?
No fix has been published for CVE-2019-11581 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 7 Sep 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-11581 being exploited?
Yes. Attackers have exploited CVE-2019-11581 in the wild since at least 7 Mar 2022.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Jira Server
Sources
Also known as GHSA-55hv-x43w-phcv.