Rapid7 Vulnerability & Exploit Database

Atlassian Crowd and Crowd Data Center RCE (CVE-2019-11580)

Back to Search

Atlassian Crowd and Crowd Data Center RCE (CVE-2019-11580)

Severity
9
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
06/03/2019
Created
12/10/2020
Added
12/09/2020
Modified
05/03/2022

Description

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.

Solution(s)

  • atlassian-crowd-upgrade-3-0-5
  • atlassian-crowd-upgrade-3-1-6
  • atlassian-crowd-upgrade-3-2-8
  • atlassian-crowd-upgrade-3-3-5
  • atlassian-crowd-upgrade-3-4-4

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;