Is CVE-2019-15005 actively exploited?

No active exploitation of CVE-2019-15005 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-15005 be exploited remotely?

Yes. CVE-2019-15005 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-15005?

CVE-2019-15005 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2019-15005

MEDIUM

CVE-2019-15005

CWE-862Published: November 8, 2019· Updated: Jun 17, 2026

4.3

CVSS v3.1

Official Description

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.

NVD Source

Technical Analysis

CVE-2019-15005 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.