---
title: "Jira SSTI (CVE-2019-11581)"
canonical: https://trickest.com/library/cve-2019-11581-jira-ssti
description: "Flag Atlassian Jira hosts for CVE-2019-11581 by reading version on GET /login.jsp. Floors 7.6.14 / 7.13.5 / 8.0.3 / 8.1.2 / 8.2.3. No SSTI."
---

# Jira SSTI (CVE-2019-11581)

## Overview

This workflow finds Atlassian Jira Server and Data Center and sorts each host by whether its version falls below the CVE-2019-11581 fixed floors. CVE-2019-11581 is server-side template injection in Jira that can lead to remote code execution. This check never sends a template and never hits a contact or SMTP form. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/login.jsp`, fingerprints Jira from page markers, reads the version string, and compares it to the per-branch table in the graph. Builds older than 4.4.0 are treated as not affected. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when Jira 7.x and 8.x fleets lag on patch windows. A node that stayed on 8.2.2 after neighbours moved is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/login.jsp` on each host and fingerprint Jira from page markers and version strings on that response.
3. Parse the version and compare it to the CVE-2019-11581 floors in the graph (7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3), treating builds below 4.4.0 as not affected.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Jira was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/login.jsp` only. No contact form, no SMTP path, and no SSTI template.

## Sample output

The records below are illustrative and do not come from a real run. They show one Jira host below a CVE-2019-11581 floor, one at or above its floor, and one host that is not the product.

```jsonl
{"url": "https://jira.example.com", "is_product": true, "product_version": "8.2.2", "vulnerable": true, "detail": "below branch floor 8.2.3"}
{"url": "https://jira.example.org", "is_product": true, "product_version": "8.2.3", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Atlassian Jira"}
```

```json
{"cve": "CVE-2019-11581", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Jira versions does this flag?

Builds below the per-branch floors in the graph: 7.6.14, 7.13.5, 8.0.3, 8.1.2, and 8.2.3. Versions below 4.4.0 are not affected. The compare uses the version Jira itself served on `/login.jsp`.

### Does an affected row mean SSTI ran?

No. The check only GETs `/login.jsp` and reads the version. It does not submit a template and it does not confirm RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not send mail or change Jira state.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2019-11581?

Server-side template injection in Atlassian Jira Server and Data Center that can lead to remote code execution. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Jira Path Traversal (CVE-2021-26086)](/library/atlassian-jira-server-and-data-center-path-traversal-cve-2021-26086). Reach for it when you need the path traversal check on the same Jira fleet.
- [Confluence SSTI RCE (CVE-2019-3396)](/library/cve-2019-3396-confluence-widget-connector-ssti-rce). Reach for it when you need the Confluence Widget Connector SSTI fingerprint next door.
- [SharePoint XML RCE (CVE-2019-0604)](/library/cve-2019-0604-sharepoint-xml-deserialization-rce). Reach for it when the next enterprise app check is SharePoint deserialization exposure.

---
_Markdown source of https://trickest.com/library/cve-2019-11581-jira-ssti._