{"id":"CVE-2019-11581","kind":"vulnerability","aliases":["CVE-2019-11581"],"related":[],"title":"Atlassian Jira Server and Data Center: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability","description":"There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.","summary":"Server-side template injection in Jira Server/Data Center ContactAdministrators and SendBulkMail actions gives remote code execution. Needs an SMTP server configured in Jira, plus either the Contact Administrators form enabled (no authentication needed) or Jira Administrator access. Introduced in 4.4.0. Jira Cloud is not affected. Jira Service Desk 3.0.0 to before 4.2.3 may be affected (check the compatibility matrix).","severity":"critical","cvss":9.8,"epss":0.84621,"exploited":true,"exploited_at":"2022-03-07T00:00:00+00:00","products":[{"name":"Atlassian Jira Server and Data Center","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Jira Server and Data Center","fixed":["7.6.14","7.13.5","8.0.3","8.1.2","8.2.3","8.2.4"],"affected":">= 4.4.0, < 7.6.14; >= 7.7.0, < 7.13.5; >= 8.0.0, < 8.0.3; >= 8.1.0, < 8.1.2; >= 8.2.0, < 8.2.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["atlassian","exploited","jira","rce","self-hosted","template-injection","vendor"],"not_affected_if":["atlassian-cloud","jira-cloud","managed-hosting","no-smtp-configured","not-internet-exposed"],"how_to_check":"Check the Jira version (Administration > System info). Vulnerable if below 7.6.14 (up to 7.12.x), below 7.13.5 (7.13.x), below 8.0.3, below 8.1.2 or below 8.2.3. Exposure also needs an SMTP server configured and the Contact Administrators form enabled. To look for exploitation, grep <JIRA_INSTALL>/logs/access_log.* for POSTs to /secure/ContactAdministrators!default.jspa and SendBulkMail. Count requests per external IP, and check for emails with odd subjects or bodies (such as « 2 ») or SMTP content-block errors. Logs may have been rotated or tampered with.","fix":"Upgrade to 7.6.14, 7.13.5 (recommended for Enterprise releases), 8.0.3, 8.1.2, 8.2.3, or latest (8.2.4 or later). Workaround: disable the Contact Administrators form and block /secure/ContactAdministrators, plus /secure/admin/SendBulkMail!default.jspa, /admin/SendBulkMail!default.jspa and /SendBulkMail!default.jspa at the reverse proxy or load balancer.","status":"open","published_at":"2019-08-09T20:15:11+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:20+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T21:22:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates from Atlassian per vendor instructions, as listed by CISA. Affected and fixed versions: unknown from the sources.","reach":"internet","impact":"high","summary":"Atlassian Jira Server and Data Center has a server-side template injection flaw in its template handling. An unauthenticated or low-privilege attacker can inject template code that the server executes, which allows remote code execution.","category":"vendor","who_cares":["jira","self-hosted","atlassian"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the Jira server remotely","analyst_note":"Find affected and fixed Jira versions and the authentication requirement from Atlassian's advisory for CVE-2019-11581 and a detection method for the template injection.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["atlassian-cloud"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000459,"input_tokens":2841,"output_tokens":349,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected and fixed Jira versions and the authentication requirement from Atlassian's advisory for CVE-2019-11581 and a detection method for the template injection.","search":"'-11581':21A,24A '-2019':20A,23A '3.0.0':96B '4.2.3':99B '4.4.0':87B,159C '7.13.5':165C '7.6.14':161C '7.7.0':163C '8.0.0':167C '8.0.3':169C '8.1.0':171C '8.1.2':173C '8.2.0':176C '8.2.3':178C 'abl':132C 'access':84B 'action':59B,128C 'administr':75B,83B 'affect':92B,102B,180C 'and':28A,33A 'atlassian':1A,7A,25A,36B 'attack':130C 'authent':79B 'center':6A,12A,30A,35A,55B,121C,149C,157C 'check':103B 'cloud':89B 'code':62B,136C 'compat':105B 'configur':68B 'contact':74B 'contactadministr':56B,124C 'cve':19A,22A 'data':5A,11A,29A,34A,120C,148C,156C 'desk':95B 'either':72B 'enabl':77B 'execut':63B,135C 'exploit':37B 'form':76B 'give':60B 'host':42B 'inject':17A,45B,51B,114C 'introduc':85B 'jira':2A,8A,26A,31A,38B,53B,70B,82B,88B,93B,117C,145C,153C 'matrix':106B 'may':100B 'need':64B,80B 'plus':71B 'rce':39B 'remot':61B,134C 'run':140C 'self':41B 'self-host':40B 'sendbulkmail':58B,127C 'server':3A,9A,14A,27A,32A,48B,67B,111C,118C,146C,154C 'server-sid':13A,47B,110C 'server/data':54B 'servic':94B 'side':15A,49B,112C 'smtp':66B 'system':138C 'templat':16A,44B,50B,113C 'template-inject':43B 'vendor':46B 'version':143C,151C 'vulner':18A,115C,142C,183C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-08-09T20:15:11+00:00","kev":{"dateAdded":"2022-03-07","dueDate":"2022-09-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-11581","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11581","severity":null,"published_at":"2022-03-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2019-11581","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11581","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2019-11581:65","url":null,"severity":null,"published_at":"2026-10-23T21:23:42+00:00","modified_at":"2026-10-23T21:23:42+00:00","first_seen_at":"2026-10-23T21:23:42+00:00","fetched_at":"2026-10-23T21:23:42+00:00","note":"Read Atlassian advisory 2019-07-10 and its compromise-detection guide. Exploitable unauthenticated only if SMTP configured AND Contact Administrators form enabled; otherwise needs Jira admin. No public PoC link checked; KEV lists exploited."},{"source":"nvd","external_id":"CVE-2019-11581","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11581","severity":null,"published_at":"2019-08-09T20:15:11+00:00","modified_at":"2026-06-17T02:13:12+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":978,"url":"https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html","title":"Jira Security Advisory 2019-07-10 (CVE-2019-11581)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":986,"url":"https://confluence.atlassian.com/adminjiraserver/determining-whether-your-jira-instance-has-been-compromised-by-cve-2019-11581-1047539914.html","title":"Determining whether your Jira instance has been compromised by CVE-2019-11581","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}