ZeroDay Findings
Sign inSign up

Findings

CVE-2019-11581

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Published Aug 9, 2019 · updated Jun 16, 2026 · atlassian jira server

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 9, 2019 · Catalog

    Detected

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 bef

  2. Mar 7, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Sep 7, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 bef

Required action

Apply updates per vendor instructions.

CISA due date Sep 7, 2022

Affected

  • cpe atlassian/jira serverversion unspecified
  • vendor Atlassian Jira Server and Data Centerversion unspecified

Sources

  • CISA KEVCVE-2019-11581

    Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.

    cisa.gov
  • CVE.orgCVE-2019-11581

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-11581

    30-day exploitation probability 84.6%

    first.org
  • NIST NVDCVE-2019-11581

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of

    nvd.nist.gov

References