CVE-2019-11580
Atlassian Crowd 2.1.0 – 3.0.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2019-11580 is a critical-severity an unspecified weakness vulnerability in Atlassian Crowd. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Atlassian Crowd and Crowd Data Center versions from 2.1.0 through 3.4.3 contain a misconfiguration in which the pdkinstall development plugin remains enabled in release builds. This component accepts plugin installation requests without proper restrictions, directly exposing the application to arbitrary code deployment on the underlying server.
Unauthenticated attackers can send HTTP requests to the affected pdkinstall endpoint to upload and activate malicious plugins. Successful exploitation grants remote code execution with the privileges of the Crowd process, allowing full compromise of confidentiality, integrity, and availability as reflected in the CVSS 9.8 score.
The vendor advisory at https://jira.atlassian.com/browse/CWD-5388 identifies fixed releases (3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4) and recommends immediate upgrade. Public exploit code published on Packet Storm demonstrates practical remote code execution against unpatched instances, confirming the issue has been weaponized in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-3250
Vulnerability Data
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins,…
more
which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.