CVE-2022-43782

published 2022-11-17

CVE-2022-43782: Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path.

This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default.

The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3

Affected

6 ranges

Vendor	Product	Version range	Fixed in
atlassian	crowd	>= 3.0.0 < 4.4.4	4.4.4
atlassian	crowd	>= 5.0.0 < 5.0.3	5.0.3
atlassian	crowd_data_center	—	—
atlassian	crowd_data_center	—	—
atlassian	crowd_server	—	—
atlassian	crowd_server	—	—

CWE-287