FRDE Sign in Free trial
Background exploitation KEV catalog Ransomware No authentication
CVE-2019-11580

Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this…

CheckOps priority index
9.8/10 Patch within 24 h
Severity9.8
Probability9.5
Exploitation5/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 95.4% higher than 99.9% of CVEs
CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:
Exploited for 1,826 days 03 Nov 2021
CISA due date 03 May 2022 for US federal agencies

Exploitation probability EPSS · FIRST

05010026 Sep05 Oct15 Oct24 Oct02 Nov
EPSS probability (%)Percentile among all CVEs

Exploitation signals 5 / 5

  • KEV catalog (CISA)03 Nov 2021
  • Exploited in EUVD (ENISA)03 Nov 2021
  • Used by ransomwareyes
  • EPSS above 10 %95.4%
  • No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply updates per vendor instructions.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

Affected products

CrowdCrowd and Crowd Data Center
Affected versions
  • 3.1.0 <unspecified
  • 3.3.0 <unspecified
  • 3.2.0 <unspecified
  • unspecified <3.3.5
  • unspecified <3.2.8
  • 2.1.0 <unspecified
  • 3.4.0 <unspecified
  • unspecified <3.0.5
  • unspecified <3.4.4
  • unspecified <3.1.6

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

  1. Published

  2. Exploitation reported (ENISA)

  3. Added to the KEV catalog

  4. CISA remediation due date

  5. EPSS peak: 95.4%

References

Other exploited vulnerabilities from the same vendor

  • CVE-2026-21589Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
    9.1 · Rising fast
  • CVE-2021-26086Atlassian Jira Server and Data Center Path Traversal Vulnerability
    7.5 · Background exploitation
  • CVE-2023-22527Atlassian Confluence Data Center and Server Template Injection Vulnerability
    10.0 · Background exploitation
  • CVE-2023-22518Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
    10.0 · Background exploitation
  • CVE-2023-22515Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
    10.0 · Background exploitation
  • CVE-2022-36804Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
    8.3 · Background exploitation

Are you affected?

CheckOps reads your SBOMs and scans, and alerts you as soon as one of your dependencies is exploited.

Get notified at launch

Sources: CISA KEV · ENISA EUVD · FIRST EPSS · OSV. Public data aggregated by CheckOps, updated automatically. Source texts remain the property of their authors. All exploited vulnerabilities