Atlassian
Atlassian Crowd: vulnerabilidades y CVE
Atlassian Crowd tiene 24 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 5 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE24
Últimos 12 meses1
Críticas5
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-11580 | Crítica (9.8) | 95% | ⚠ Explotación activa | 3 jun 2019 | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-21569 | Alta (7.9) | 0.33% | — | 28 ene 2026 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. * Crowd Data Center and Server 7.1: Upgrade to a release greater than or equal to… |
| CVE-2023-22521 | Alta (8.8) | 1.2% | — | 21 nov 2023 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an… |
| CVE-2022-43782 | Crítica (9.8) | 0.95% | — | 17 nov 2022 | Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the… |
| CVE-2022-26137 | Alta (8.8) | 2.3% | — | 20 jul 2022 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed… |
| CVE-2022-26136 | Crítica (9.8) | 5.4% | — | 20 jul 2022 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how… |
| CVE-2020-36240 | Media (5.3) | 1.3% | — | 1 mar 2021 | The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an… |
| CVE-2019-20902 | Alta (7.5) | 0.87% | — | 1 oct 2020 | Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1. |
| CVE-2019-20104 | Alta (7.5) | 2.4% | — | 6 feb 2020 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. |
| CVE-2017-18107 | Media (6.5) | 0.45% | — | 17 dic 2019 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability.… |
| CVE-2019-15005 | Media (4.3) | 1.3% | — | 8 nov 2019 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing… |
| CVE-2019-11580 | Crítica (9.8) | 95% | ⚠ Explotación activa | 3 jun 2019 | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center… |
| CVE-2018-20239 | Media (5.4) | 3.3% | — | 30 abr 2019 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject… |
| CVE-2017-18110 | Media (6.5) | 1.2% | — | 29 mar 2019 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability. |
| CVE-2017-18109 | Media (6.1) | 1.1% | — | 29 mar 2019 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing… |
| CVE-2017-18108 | Alta (7.2) | 2.3% | — | 29 mar 2019 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection. |
| CVE-2017-18106 | Alta (7.5) | 1.2% | — | 29 mar 2019 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can… |
| CVE-2017-18105 | Alta (8.1) | 1.4% | — | 29 mar 2019 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of… |
| CVE-2018-20238 | Alta (8.1) | 1.5% | — | 13 feb 2019 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration… |
| CVE-2016-10740 | Media (4.9) | 1.1% | — | 29 ene 2019 | Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these… |
| CVE-2017-16858 | Media (6.8) | 0.57% | — | 31 ene 2018 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to… |
| CVE-2016-6496 | Crítica (9.8) | 4.7% | — | 9 dic 2016 | The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning. |
| CVE-2013-3926 | Alta (7.5) | 1.9% | — | 1 jul 2013 | Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not reproduce the issue, stating "We've been… |
| CVE-2013-3925 | Media (5.8) | 1.8% | — | 1 jul 2013 | Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request to (1) /services/2 or (2) services/latest… |
| CVE-2012-2926 | Crítica (9.1) | 66% | — | 22 may 2012 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.