Security Misconfiguration Vulnerability in Atlassian Crowd

CVE-2022-43782

What is CVE-2022-43782?

A vulnerability in Atlassian Crowd allows attackers to authenticate as the application due to security misconfiguration. Exploitation can occur through the ability to invoke privileged endpoints in Crowd's REST API, specifically under the {{usermanagement}} path. This vulnerability is limited to IPs specified in the application's allowlist, which is empty by default, exposing all users to potential unauthorized access. Affected versions include all versions from 3.x.x, 4.x.x prior to 4.4.4, and 5.x.x before 5.0.3.

References