Remote Code Execution Vulnerability in Atlassian Crowd and Crowd Data Center
CVE-2019-11580

9.8CRITICAL

Key Information:

Vendor: Atlassian
Status: Crowd
Vendor: CVE Published:; 3 June 2019

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 97%🦅 CISA Reported

Summary

Atlassian Crowd and Crowd Data Center possess a significant security vulnerability due to the pdkinstall development plugin being improperly enabled in release builds. This flaw allows attackers to send unauthenticated or authenticated requests to a vulnerable instance, enabling them to install arbitrary plugins. Such unauthorized installations could lead to remote code execution, exposing systems that run affected versions of Crowd to severe risks. It is crucial for users to apply the necessary patches and upgrade to the fixed versions to mitigate potential security breaches.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Crowd 2.1.0

Crowd < 3.0.5

Crowd 3.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-11580
Created by jas502n