Remote Code Execution Vulnerability in Atlassian Crowd and Crowd Data Center
CVE-2019-11580

9.8CRITICAL

Key Information:

Vendor: Atlassian
Status: Crowd
Vendor: CVE Published:; 3 June 2019

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%🦅 CISA Reported

What is CVE-2019-11580?

Atlassian Crowd and Crowd Data Center possess a significant security vulnerability due to the pdkinstall development plugin being improperly enabled in release builds. This flaw allows attackers to send unauthenticated or authenticated requests to a vulnerable instance, enabling them to install arbitrary plugins. Such unauthorized installations could lead to remote code execution, exposing systems that run affected versions of Crowd to severe risks. It is crucial for users to apply the necessary patches and upgrade to the fixed versions to mitigate potential security breaches.

CISA has reported CVE-2019-11580

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2019-11580 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Crowd 2.1.0

Crowd < 3.0.5

Crowd 3.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-11580
Created by jas502n