by Kastro
Paper/Archive/CVE-2022-43782

CVE-2022-43782

Atlassian Crowd Data Center — Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequ…

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.7.617 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3

Affected

ProductAffectedFixed inSource
Crowd Data Centerbefore 4.4.4–CNA
Crowd Data Centerbefore 5.0.3–CNA
Crowd Serverbefore 4.4.4–CNA
Crowd Serverbefore 5.0.3–CNA
crowd3.0.0 – < 4.4.44.4.4CISA-ADP
crowd5.0.0 – < 5.0.35.0.3CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjira.atlassian.com/browse/CWD-5888