CVE-2019-11580

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

• http://packetstormsecurity.com/files/163810/Atlassian-Crowd-pdkinstall-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108637Broken Link
• https://jira.atlassian.com/browse/CWD-5388Issue Tracking, Mitigation, Vendor Advisory
• http://packetstormsecurity.com/files/163810/Atlassian-Crowd-pdkinstall-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108637Broken Link
• https://jira.atlassian.com/browse/CWD-5388Issue Tracking, Mitigation, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11580US Government Resource

Published

Jun 3, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11574An issue was discovered in Simple Machines Forum (SMF) befor…9.8
• CVE-2019-11576Gitea before 1.8.0 allows 1FA for user accounts that have co…
• CVE-2019-11577dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_find…
• CVE-2019-11578auth.c in dhcpcd before 7.2.1 allowed attackers to infer sec…5.9
• CVE-2019-11579dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflo…5.3
• CVE-2019-1158An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-11581There was a server-side template injection vulnerability in …9.8
• CVE-2019-11582An argument injection vulnerability in Atlassian Sourcetree …
• CVE-2019-11583The issue searching component in Jira before version 8.1.0 a…
• CVE-2019-11584The MigratePriorityScheme resource in Jira before version 8.…
• CVE-2019-11585The startup.jsp resource in Jira before version 7.13.6, from…
• CVE-2019-11586The AddResolution.jspa resource in Jira before version 7.13.…