Authentication Bypass in Atlassian Crowd 'crowd-application' Plugin

CVE-2017-16858

What is CVE-2017-16858?

The 'crowd-application' plugin in Atlassian Crowd enables attackers to impersonate legitimate users due to a flaw in REST API authentication. This vulnerability arises when an attacker accesses the REST interface of a directory linked to an application, using credentials of a user from a different directory. For instance, if directory 1 has a user 'admin' while directory 2 also has an 'admin' user, it allows the attacker to authenticate as the admin user of directory 1 by exploiting the authentication capabilities of directory 2. This can lead to unauthorized access, data leakage, and potential control over sensitive operations within the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References