Cyber Resilience

CVE-2019-11580

Atlassian Crowd 2.1.0 – 3.0.5

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRansomware-linked
Published
03 June 2019
Modified
24 October 2025
KEV Added
03 November 2021
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.95 99.9th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2019-11580 is a critical-severity an unspecified weakness vulnerability in Atlassian Crowd. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Atlassian Crowd and Crowd Data Center versions from 2.1.0 through 3.4.3 contain a misconfiguration in which the pdkinstall development plugin remains enabled in release builds. This component accepts plugin installation requests without proper restrictions, directly exposing the application to arbitrary code deployment on the underlying server.

Unauthenticated attackers can send HTTP requests to the affected pdkinstall endpoint to upload and activate malicious plugins. Successful exploitation grants remote code execution with the privileges of the Crowd process, allowing full compromise of confidentiality, integrity, and availability as reflected in the CVSS 9.8 score.

The vendor advisory at https://jira.atlassian.com/browse/CWD-5388 identifies fixed releases (3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4) and recommends immediate upgrade. Public exploit code published on Packet Storm demonstrates practical remote code execution against unpatched instances, confirming the issue has been weaponized in the wild.

EU & UK References

Vulnerability Data

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins,…

more

which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

CWE(s)
KEV Date Added
03 November 2021

Related Threats

CVEs Like This One

CVE-2023-22521Same product: Atlassian Crowd
CVE-2026-21569Same product: Atlassian Crowd
CVE-2019-3398Same vendor: Atlassianboth on KEV
CVE-2021-26084Same vendor: Atlassianboth on KEV
CVE-2019-3396Same vendor: Atlassianboth on KEV
CVE-2023-22515Same vendor: Atlassianboth on KEV
CVE-2022-26134Same vendor: Atlassianboth on KEV
CVE-2021-26085Same vendor: Atlassianboth on KEV
CVE-2022-36804Same vendor: Atlassianboth on KEV
CVE-2019-11581Same vendor: Atlassianboth on KEV

Affected Assets

atlassian
crowd
2.1.0 — 3.0.5 · 3.1.0 — 3.1.6 · 3.2.0 — 3.2.8

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References