Atlassian Crowd pdkinstall Development Plugin Enabled Remote Code Execution (CVE-2019-11580)
Executive & SecOps Summary
SECOPS ASSESSMENTAtlassian Crowd and Crowd Data Center from version 2.1.0 up to 3.4.4 (specific minor version ranges)
Unauthenticated remote attackers can upload and install arbitrary plugins, leading to complete remote code execution (RCE) on the host system
Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates immediately by upgrading to the designated safe versions for your release branch.
# 1. Stop the running Crowd service
sudo systemctl stop crowd
# 2. Download and extract the patched version (e.g., version 3.4.4)
wget https://www.atlassian.com/software/crowd/downloads/binary/atlassian-crowd-3.4.4.tar.gz
tar -xzf atlassian-crowd-3.4.4.tar.gz -C /opt/atlassian/
# 3. Restore configuration files and restart the service
sudo systemctl start crowd2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, remove the vulnerable pdkinstall JAR file from the installation directory and block access to the plugin upload endpoints.
# Locate and remove the pdkinstall plugin JAR file
find /opt/atlassian/crowd -name 'pdkinstall*.jar' -exec rm -f {} \;
# Block access to the vulnerable endpoints via Nginx reverse proxy configuration
# Add the following block inside your Nginx server configuration:
# location ~* /plugins/1.0/ {
# deny all;
# return 403;
# }3. Log Audit & IoC Verification Commands
Inspect the Crowd access logs for unauthorized POST requests targeting the pdkinstall endpoints.
# Search access logs for pdkinstall endpoint access attempts
grep -i 'pdkinstall' /var/log/atlassian/crowd/atlassian-crowd-access.log
grep -E '/(admin/)?plugins/1.0' /var/log/atlassian/crowd/atlassian-crowd-access.log
# Check for unexpected JAR files in the Tomcat temporary directory
find /opt/atlassian/crowd/apache-tomcat/temp/ -name '*.jar'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability arises because the 'pdkinstall' development and testing plugin was incorrectly left enabled in production release builds of Atlassian Crowd and Crowd Data Center. This plugin exposes an endpoint designed to facilitate rapid development by allowing dynamic installation of new plugins (JAR files) without requiring proper authentication or authorization checks.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending an unauthenticated HTTP POST request containing a malicious OSGi bundle (JAR file) to the '/crowd/admin/plugins/1.0/' or '/admin/plugins/1.0/' endpoints. Because the pdkinstall servlet processes this request without validating the sender's identity or administrative session, it automatically installs and executes the uploaded JAR file. This allows the attacker to run arbitrary Java code within the context of the Crowd application process, achieving full Remote Code Execution (RCE).
3. Infrastructure & Business Impact
Atlassian Crowd serves as a centralized identity management and Single Sign-On (SSO) hub for enterprise environments. A successful compromise of the Crowd server allows attackers to harvest directory credentials and pivot to integrated critical systems such as Jira, Confluence, and Bitbucket. This poses an extreme risk of widespread lateral movement, data exfiltration, and complete infrastructure compromise.
Official Vendor Advisories & References
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
Frequently Asked SecOps Questions (CVE-2019-11580)
FAQQ1. How critical is CVE-2019-11580 and is it actively exploited in the wild?
CVE-2019-11580 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 95.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-11580?
Primary impacted vendors include atlassian across crowd, crowd_data_center. Scope summary: Atlassian Crowd and Crowd Data Center versions: - 2.1.0 to before 3.0.5 - 3.1.0 to before 3.1.6 - 3.2.0 to before 3.2.8 - 3.3.0 to before 3.3.5 - 3.4.0 to before 3.4.4
Q3. What temporary mitigations or workarounds exist for CVE-2019-11580 before patching?
[Mitigation] Immediately upgrade to the fixed versions (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4 or later) or disable/remove the pdkinstall plugin Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-11580
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.