CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22521
https://notcve.org/view.php?id=CVE-2023-22521
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Crowd Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center and Server 3.4: Upgrade to a release greater than or equal to 5.1.6 Crowd Data Center and Server 5.2: Upgrade to a release greater than or equal to 5.2.1 See the release notes ([https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html]). You can download the latest version of Crowd Data Center and Server from the download center ([https://www.atlassian.com/software/crowd/download-archive]). This vulnerability was discovered by m1sn0w and reported via our Bug Bounty program Esta vulnerabilidad RCE (ejecución remota de código) de alta gravedad se introdujo en la versión 3.4.6 de Crowd Data Center and Server. Esta vulnerabilidad RCE (ejecución remota de código), con una puntuación CVSS de 8.0, permite a un atacante autenticado ejecutar código arbitrario que tiene un alto impacto en la confidencialidad, un alto impacto en la integridad, un alto impacto en la disponibilidad y no requiere interacción del usuario. Atlassian recomienda que los clientes de Crowd Data Center and Server actualicen a la última versión; si no pueden hacerlo, actualicen su instancia a una de las versiones fijas admitidas especificadas: Crowd Data Center and Server 3.4: actualice a una versión superior o igual a 5.1.6 Crowd Data Center and Server 5.2: actualice a una versión mayor o igual a 5.2.1 Consulte las notas de la versión ([https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html] ). Puede descargar la última versión de Crowd Data Center and Server desde el centro de descargas ([https://www.atlassian.com/software/crowd/download-archive]). • https://confluence.atlassian.com/pages/viewpage.action?pageId=1318881573 https://jira.atlassian.com/browse/CWD-6139 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43782
https://notcve.org/view.php?id=CVE-2022-43782
Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default. The affected versions are all versions 3.x.x, versions 4.x.x before version 4.4.4, and versions 5.x.x before 5.0.3 Las versiones afectadas de Atlassian Crowd permiten a un atacante autenticarse como aplicación multitud a través de una mala configuración de seguridad y la posterior capacidad de llamar a endpoints privilegiados en la API REST de Crowd bajo la ruta {{usermanagement}}. Esta vulnerabilidad solo puede ser explotada por las IP especificadas en la lista de aplicaciones permitidas en la configuración de Direcciones Remotas, que es {{none}} de forma predeterminada. Las versiones afectadas son todas las versiones 3.xx, versiones 4.xx anteriores a la versión 4.4.4 y versiones 5.xx anteriores a 5.0.3. • https://jira.atlassian.com/browse/CWD-5888 •
CVSS: 8.8EPSS: 0%CPEs: 42EXPL: 0CVE-2022-26137
https://notcve.org/view.php?id=CVE-2022-26137
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. • https://jira.atlassian.com/browse/BAM-21795 https://jira.atlassian.com/browse/BSERV-13370 https://jira.atlassian.com/browse/CONFSERVER-79476 https://jira.atlassian.com/browse/CRUC-8541 https://jira.atlassian.com/browse/CWD-5815 https://jira.atlassian.com/browse/FE-7410 https://jira.atlassian.com/browse/JRASERVER-73897 https://jira.atlassian.com/browse/JSDSERVER-11863 • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CWE-346: Origin Validation Error •
CVSS: 9.8EPSS: 0%CPEs: 42EXPL: 0CVE-2022-26136
https://notcve.org/view.php?id=CVE-2022-26136
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. • https://jira.atlassian.com/browse/BAM-21795 https://jira.atlassian.com/browse/BSERV-13370 https://jira.atlassian.com/browse/CONFSERVER-79476 https://jira.atlassian.com/browse/CRUC-8541 https://jira.atlassian.com/browse/CWD-5815 https://jira.atlassian.com/browse/FE-7410 https://jira.atlassian.com/browse/JRASERVER-73897 https://jira.atlassian.com/browse/JSDSERVER-11863 • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-36240
https://notcve.org/view.php?id=CVE-2020-36240
The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. La clase ResourceDownloadRewriteRule en Crowd versiones anteriores a 4.0.4, y desde versión 4.1.0 versiones anteriores a 4.1.2, permitía a atacantes remotos no autenticados leer archivos arbitrarios dentro de los directorios WEB-INF y META-INF por medio de una comprobación de acceso a una ruta incorrecta • https://jira.atlassian.com/browse/CWD-5685 •