CVE-2019-20902

2020-10-0101:30:19

atlassian

www.cve.org

cve-2019-20902

crowd

xml data transfer

openldap

security vulnerability

EPSS

0.001

Percentile

42.2%

JSON

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

CNA Affected

[
  {
    "product": "Crowd",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "3.4.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "3.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "3.5.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

jira.atlassian.com/browse/CWD-5409

EPSS

0.001

Percentile

42.2%

JSON

Related for CVELIST:CVE-2019-20902