CVE-2019-11580 on CISA KEV

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins

01What CISA says about this vulnerability

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All…

02Required action — verbatim from CISA

Apply updates per vendor instructions.

03Notes & references

• jira.atlassian.com — https://jira.atlassian.com/browse/CWD-5388
• www.securityfocus.com — http://www.securityfocus.com/bid/108637
• packetstormsecurity.com — http://packetstormsecurity.com/files/163810/Atlassian-Crowd-pdkinstall-Remote-Co…

04SARA's analyst layer — why this matters

This vulnerability is currently on the CISA KEV list, which CISA only adds CVEs to when there is reliable evidence of active exploitation in the wild. For federal civilian agencies, BOD 22-01 requires remediation by the due date above. For everyone else, KEV is the strongest "patch immediately" signal you can get from public threat intel.

05Affected products (summary)

Vendor	Product	Versions
Atlassian	Crowd	2.1.0, unspecified, 3.1.0, unspecified, 3.2.0, unspecified, 3.3.0, unspecified, 3.4.0, unspecified

06Detection

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection:

Open in Sigma generator →