Live › vulnerability › CVE-2019-11581
Go to dashboardServer-side template injection in Jira Server/Data Center ContactAdministrators and SendBulkMail actions gives remote code execution. Needs an SMTP server configured in Jira, plus either the Contact Administrators form enabled (no authentication needed) or Jira Administrator access. Introduced in 4.4.0. Jira Cloud is not affected. Jira Service Desk 3.0.0 to before 4.2.3 may be affected (check the compatibility matrix).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Atlassian Jira Server and Data Center | vendor | – | – |
| Jira Server and Data Center | vendor | >= 4.4.0, < 7.6.14; >= 7.7.0, < 7.13.5; >= 8.0.0, < 8.0.3; >= 8.1.0, < 8.1.2; >= 8.2.0, < 8.2.3 | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3, 8.2.4 |
7.6.14 (up to 7.12.x), below 7.13.5 (7.13.x), below 8.0.3, below 8.1.2 or below 8.2.37.6.14, 7.13.5 (recommended for Enterprise releases), 8.0.3, 8.1.2, 8.2.3, or latest (8.2.4 or later)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2019-11581")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.