TI-2019-08653 Aliases CVE-2019-11580 GHSA-8977-4jwc-24g8

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly…

CRITICAL 100Exploited in the wildPublished 2019-06-03 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03Known ransomware use

EPSS 0.95355 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Crowd (Atlassian): 3.0.5, 3.1.6, 3.2.8 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Crowd	2.1.0 and later; before 3.0.5; 3.1.0 and later; before 3.1.6; 3.2.0 and later; before 3.2.8; 3.3.0 and later; before 3.3.5; 3.4.0 and later; before 3.4.4	3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4	Patch available	CNA

Crowd VendorAtlassian Affected 2.1.0 and later; before 3.0.5; 3.1.0 and later; before 3.1.6; 3.2.0 and later; before 3.2.8; 3.3.0 and later; before 3.3.5; 3.4.0 and later; before 3.4.4 Fixed in 3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:crowd::::::::	2.1.0 to before 3.0.5; 3.1.0 to before 3.1.6; 3.2.0 to before 3.2.8; 3.3.0 to before 3.3.5; 3.4.0 to before 3.4.4	Vulnerable	Atlassian

cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions 2.1.0 to before 3.0.5; 3.1.0 to before 3.1.6; 3.2.0 to before 3.2.8; 3.3.0 to before 3.3.5; 3.4.0 to before 3.4.4 Vulnerable ·Atlassian

Remediation

Fix · CNA Crowd (Atlassian) Fixed in 3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4

Timeline

2021-11-03 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2019-11580
2026-10-03 Alias added: GHSA-8977-4jwc-24g8

References

Exploit 1

http://packetstormsecurity.com/files/163810/Atlassian-Crowd-pdkinstall-Remote-Code-Execution.html

Advisory 1

https://jira.atlassian.com/browse/CWD-5388

TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
TI-2022-09598 Improper authentication in Atlassian Bamboo Server CVSS 3.1CRITICAL 9.8
TI-2022-21516 Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd… CVSS 3.1CRITICAL 9.8
TI-2016-05568 The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8
TI-2022-09599 Origin validation error in Atlassian Bamboo Server CVSS 3.1HIGH 8.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences