Security Misconfiguration Vulnerability in Atlassian Crowd
CVE-2022-43782

9.8CRITICAL

Key Information:

Vendor
Atlassian
Status
Crowd Data Center
Crowd Server
Vendor
CVE Published:
17 November 2022

Summary

A vulnerability in Atlassian Crowd allows attackers to authenticate as the application due to security misconfiguration. Exploitation can occur through the ability to invoke privileged endpoints in Crowd's REST API, specifically under the {{usermanagement}} path. This vulnerability is limited to IPs specified in the application's allowlist, which is empty by default, exposing all users to potential unauthorized access. Affected versions include all versions from 3.x.x, 4.x.x prior to 4.4.4, and 5.x.x before 5.0.3.

Affected Version(s)

Crowd Data Center before 4.4.4

Crowd Data Center before 5.0.3

Crowd Server before 4.4.4

References

https://jira.atlassian.com/browse/CWD-5888

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ashish Kotha
.