Lucene search

[email protected]NVD:CVE-2019-20902

HistoryOct 01, 2020 - 2:15 a.m.

CVE-2019-20902

2020-10-0102:15:12

[email protected]

web.nvd.nist.gov

upgrading

crowd

xml data transfer

disabled user

openldap

affected versions

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

42.2%

JSON

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.

Affected configurations

Nvd

Node

atlassiancrowdRange<3.4.6

atlassiancrowdRange3.5.0–3.5.1

VendorProductVersionCPE
atlassiancrowd*cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	crowd	*	cpe:2.3:a:atlassian:crowd::::::::

References

jira.atlassian.com/browse/CWD-5409

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

42.2%

JSON

Related for NVD:CVE-2019-20902

prion1 atlassian2 cve1 cvelist1