Secuno
ENNL
Book demo

CVE-2019-11580

Atlassian Crowd and Crowd Data Center Remote Code Execution

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 95.4%
  1. Published3 Jun 2019
  2. Added to CISA KEV3 Nov 2021
  3. Remediation due3 May 2022
Actively exploited (CISA KEV)

Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.

Added to KEV: 3 Nov 2021Federal remediation due: 3 May 2022Used in ransomware

Description

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Atlassian Crowd≥ 2.1.0 < 3.0.5 · ≥ 3.1.0 < 3.1.6 · ≥ 3.2.0 < 3.2.8 · ≥ 3.3.0 < 3.3.5

Remediation

Fixed in
Atlassian Crowd≥ 3.0.5

References

Frequently asked

Is CVE-2019-11580 being actively exploited?

Yes. CVE-2019-11580 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021. It has been used in ransomware campaigns.

How severe is CVE-2019-11580?

CVE-2019-11580 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 95.4% probability of exploitation.

Which products are affected by CVE-2019-11580?

Affected products include Atlassian Crowd.

How do I fix CVE-2019-11580?

Upgrade affected software to a fixed version, for example Atlassian Crowd 3.0.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-11580 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.