The Crowd LDAP directory connector allowed an attacker to gain remote code execution in Crowd by injecting malicious attributes in LDAP entries. To exploit this issue, attackers need to modify an entry in your LDAP directory or successfully execute a Man-in-The-Middle attack between an LDAP server and Crowd. Crowd installations configured to communicate with an LDAP server using the LDAPS protocol with the Secure SSL option enabled are immune to this attack vector only (unless an attacker is able to obtain the private key of the SSL/TLS certificate used to secure the communication).
Affected versions:
Fix:
Risk Mitigation:
\
Acknowledgements:
We would like to credit Alvaro Munoz and Alexander Mirosh of HPE Security Fortify for reporting this issue to us.
\
For additional details see the [full advisory|https://confluence.atlassian.com/x/wykQMw].