Security Misconfiguration Vulnerability in Atlassian Crowd
CVE-2022-43782

9.8CRITICAL

Key Information:

Vendor

Atlassian
Status
Crowd Data Center
Crowd Server
Vendor
CVE Published:
17 November 2022

What is CVE-2022-43782?

A vulnerability in Atlassian Crowd allows attackers to authenticate as the application due to security misconfiguration. Exploitation can occur through the ability to invoke privileged endpoints in Crowd's REST API, specifically under the {{usermanagement}} path. This vulnerability is limited to IPs specified in the application's allowlist, which is empty by default, exposing all users to potential unauthorized access. Affected versions include all versions from 3.x.x, 4.x.x prior to 4.4.4, and 5.x.x before 5.0.3.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Crowd Data Center before 4.4.4

Crowd Data Center before 5.0.3

Crowd Server before 4.4.4

References

https://jira.atlassian.com/browse/CWD-5888

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ashish Kotha
JSON
.