CVE-2019-20902

Summary: CVE-2019-20902 describes a vulnerability in Crowd where upgrading via XML Data Transfer can reactivate a disabled OpenLDAP user. The issue affects Crowd versions prior to 3.4.6 and 3.5.0 prior to 3.5.1; fixed in 3.4.6 and 3.5.1+ (per records). Impact/behavior: during upgrade, disabled Op...

Pre-Authorization Arbitrary File Read [Confluence, Jira, Crowd]

The VULN ticket can be seen at: https://asecurityteam.atlassian.net/browse/VULN-196971 ---- This issue was reported by an external researcher at https://securitysd.atlassian.net/browse/SEC-2455 . ---- Hello, I am Amit Laish, a security researcher from GE Digital. During one of our assessments we...

Atlassian Crowd 2.1.x < 3.0.5 / 3.1.x < 3.1.6 / 3.2.x < 3.2.8 / 3.3.x < 3.3.5 / 3.4.x < 3.4.4 RCE (direct check)

The version of Atlassian Crowd installed on the remote host is affected by a remote code execution RCE vulnerability. An unauthenticated, remote attacker can exploit this, by using pdkinstall development plugin, to install arbitrary plugins, which permits remote code execution. TRUSTED...

The vulnerability of the pdkinstall plugin in the Atlassian Crowd authentication and user management system allows a perpetrator to execute arbitrary code.

The vulnerability of the pdkinstall plugin in the Atlassian Crowd authentication and user management system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Atlassian Crowd: pdkinstall development plugin incorrectly enabled (CVE-2019-11580)

Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code...

Atlassian Crowd XML Processing Denial of Service Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. Atlassian Crowd has a security vulnerability. Allows remote attackers to perform...

CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

Design/Logic Flaw

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

CVE-2019-20104

CVE-2019-20104 affects the OpenID client in Atlassian Crowd. Versions before 3.6.2, and 3.7.0 before 3.7.1, are vulnerable to DoS via XML Entity Expansion. Mitigation: update to a fixed release (3.7.1 or newer) or disable the OpenID client app, as Crowd notes indicate the OpenID client has been d...

CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability...

XXE in OpenID client application - CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd. Please ...

XXE in OpenID client application - CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd. Please ...

Atlassian Crowd Cross-Site Request Forgery Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A cross-site request forgery vulnerability exists in the Crowd Demo application in...

CVE-2017-18107

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery CSRF vulnerability. Please be aware that the Demo application is not enabled by default...

CVE-2017-18107

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery CSRF vulnerability. Please be aware that the Demo application is not enabled by default...

Cross site request forgery (csrf)

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery CSRF vulnerability. Please be aware that the Demo application is not enabled by default...

Information disclosure in the listEntityLinks servlet resource - CVE-2019-15011

The version of the Application Links plugin used in Crowd before version 3.3.5, and from version 3.4.0 before version 3.4.4 allows remote attackers to obtain information about configured application links via a missing permissions check. See https://ecosystem.atlassian.net/browse/APL-1386 for mor...

Information disclosure in the listEntityLinks servlet resource - CVE-2019-15011

The version of the Application Links plugin used in Crowd before version 3.3.5, and from version 3.4.0 before version 3.4.4 allows remote attackers to obtain information about configured application links via a missing permissions check. See https://ecosystem.atlassian.net/browse/APL-1386 for mor...

CVE-2017-18107

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery CSRF vulnerability. Please be aware that the Demo application is not enabled by default...