Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .8462 99.7 YES
AFFECTED Product Versions Fixed Jira Server and Data Center 4.4.0 – —
TIMELINE Apr 29 Reserved by atlassian Aug 9 Published (CNA: atlassian) Mar 7 Added to CISA KEV, remediation due 2022-09-07
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
| Date | Event | Detail |
|---|---|---|
| April 29, 2019 | Reserved | Reserved by atlassian |
| August 9, 2019 | Published | Published (CNA: atlassian) |
| March 7, 2022 | KEV ADDED | Added to CISA KEV, remediation due 2022-09-07 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Atlassian | Jira Server and Data Center | — | 4.4.0 | — |
Authoritative record: CVE-2019-11581 at cve.org
Vendors: atlassian
Weaknesses: CWE-74
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-11581 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
