--- id: "CVE-2019-11581" kind: "vulnerability" aliases: ["CVE-2019-11581"] title: "Atlassian Jira Server and Data Center: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability" severity: "critical" cvss: 9.8 epss: 0.84621 exploited: true status: "open" category: "vendor" products: [{"name": "Atlassian Jira Server and Data Center", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Jira Server and Data Center", "fixed": ["7.6.14", "7.13.5", "8.0.3", "8.1.2", "8.2.3", "8.2.4"], "affected": ">= 4.4.0, < 7.6.14; >= 7.7.0, < 7.13.5; >= 8.0.0, < 8.0.3; >= 8.1.0, < 8.1.2; >= 8.2.0, < 8.2.3", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["atlassian", "exploited", "jira", "rce", "self-hosted", "template-injection", "vendor"] not_affected_if: ["atlassian-cloud", "jira-cloud", "managed-hosting", "no-smtp-configured", "not-internet-exposed"] published_at: "2019-08-09T20:15:11+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T21:57:35+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11581", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11581", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:23:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11581", "first_seen_at": "2026-10-23T21:57:35+00:00"}] --- # Atlassian Jira Server and Data Center: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability Server-side template injection in Jira Server/Data Center ContactAdministrators and SendBulkMail actions gives remote code execution. Needs an SMTP server configured in Jira, plus either the Contact Administrators form enabled (no authentication needed) or Jira Administrator access. Introduced in 4.4.0. Jira Cloud is not affected. Jira Service Desk 3.0.0 to before 4.2.3 may be affected (check the compatibility matrix). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Atlassian Jira Server and Data Center affected ? fixed ? - vendor:Jira Server and Data Center affected >= 4.4.0, < 7.6.14; >= 7.7.0, < 7.13.5; >= 8.0.0, < 8.0.3; >= 8.1.0, < 8.1.2; >= 8.2.0, < 8.2.3 fixed 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3, 8.2.4 ## How to check Check the Jira version (Administration > System info). Vulnerable if below 7.6.14 (up to 7.12.x), below 7.13.5 (7.13.x), below 8.0.3, below 8.1.2 or below 8.2.3. Exposure also needs an SMTP server configured and the Contact Administrators form enabled. To look for exploitation, grep /logs/access_log.* for POSTs to /secure/ContactAdministrators!default.jspa and SendBulkMail. Count requests per external IP, and check for emails with odd subjects or bodies (such as « 2 ») or SMTP content-block errors. Logs may have been rotated or tampered with. ## Fix Upgrade to 7.6.14, 7.13.5 (recommended for Enterprise releases), 8.0.3, 8.1.2, 8.2.3, or latest (8.2.4 or later). Workaround: disable the Contact Administrators form and block /secure/ContactAdministrators, plus /secure/admin/SendBulkMail!default.jspa, /admin/SendBulkMail!default.jspa and /SendBulkMail!default.jspa at the reverse proxy or load balancer. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11581 - 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-11581 - 2026-10-23T21:23:42+00:00 analyst — Read Atlassian advisory 2019-07-10 and its compromise-detection guide. Exploitable unauthenticated only if SMTP configured AND Contact Administrators form enabled; otherwise needs Jira admin. No public PoC link checked; KEV lists exploited. - 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-11581 ## Documents - [advisory] Jira Security Advisory 2019-07-10 (CVE-2019-11581) https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html - [mitigation] Determining whether your Jira instance has been compromised by CVE-2019-11581 https://confluence.atlassian.com/adminjiraserver/determining-whether-your-jira-instance-has-been-compromised-by-cve-2019-11581-1047539914.html ## From the sources There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_