Atlassian Crowd/Crowd Data Center up to 3.4.3 pdkinstall input validation

Summaryinfo

A vulnerability marked as critical has been reported in Atlassian Crowd and Crowd Data Center up to 3.0.4/3.1.5/3.2.7/3.3.4/3.4.3. This affects an unknown part of the component pdkinstall. This manipulation causes input validation. This vulnerability appears as CVE-2019-11580. The attack may be initiated remotely. In addition, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Atlassian Crowd and Crowd Data Center up to 3.0.4/3.1.5/3.2.7/3.3.4/3.4.3 and classified as critical. Affected by this vulnerability is an unknown code of the component pdkinstall. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was presented 05/22/2019 as Crowd Security Advisory 2019-05-22 as confirmed advisory (Website). It is possible to read the advisory at confluence.atlassian.com. This vulnerability is known as CVE-2019-11580 since 04/29/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The advisory points out:

Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center.

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/03/2021 with a due date of 05/03/2022:

Apply updates per vendor instructions.

Upgrading to version 3.0.5, 3.1.6, 3.2.8, 3.3.5 or 3.4.4 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Additional details are provided at seclists.org. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Atlassian

Name

• Crowd
• Crowd Data Center

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3

License

• free

Website

• Vendor: https://www.atlassian.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion